Disable Network File System (nfs)
An XCCDF Rule
Description
The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.
The nfs-server
service can be disabled with the following command:
$ sudo systemctl mask --now nfs-server.service
Rationale
Unnecessary services should be disabled to decrease the attack surface of the system.
- ID
- xccdf_org.ssgproject.content_rule_service_nfs_disabled
- Severity
- Unknown
- References
- Updated
Remediation - Puppet
include disable_nfs-server
class disable_nfs-server {
service {'nfs-server':
enable => false,
ensure => 'stopped',
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- CCE-82762-6
- NIST-800-53-CM-6(a)
Remediation - OS Build Blueprint
[customizations.services]
masked = ["nfs-server"]
Remediation - Kubernetes Patch
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
version: 3.1.0
Remediation - script:kickstart
service disable nfs-server
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'nfs-server.service'
"$SYSTEMCTL_EXEC" disable 'nfs-server.service'