Skip to content
Log In

Disable rpcbind Service

An XCCDF Rule

Description

The rpcbind utility maps RPC services to the ports on which they listen. RPC processes notify rpcbind when they start, registering the ports they are listening on and the RPC program numbers they expect to serve. The rpcbind service redirects the client to the proper port number so it can communicate with the requested service. If the system does not require RPC (such as for NFS servers) then this service should be disabled. The rpcbind service can be disabled with the following command: 
$ sudo systemctl mask --now rpcbind.service

Rationale

If the system does not require rpc based services, it is recommended that rpcbind be disabled to reduce the attack surface.

ID
xccdf_org.ssgproject.content_rule_service_rpcbind_disabled
Severity
Low
References
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

OS Build Blueprint

[customizations.services]
disabled = ["rpcbind"]

A Puppet Snippet

include disable_rpcbind
class disable_rpcbind {
  service {'rpcbind':
    enable => false,
    ensure => 'stopped',
  }
}

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcbind.service'
"$SYSTEMCTL_EXEC" disable 'rpcbind.service'
"$SYSTEMCTL_EXEC" mask 'rpcbind.service'

An Ansible Snippet

- name: Block Disable service rpcbind
  block:
  - name: Disable service rpcbind
    block:

    - name: Disable service rpcbind