Disable Secure RPC Server Service (rpcsvcgssd)
An XCCDF Rule
Description
The rpcsvcgssd service manages RPCSEC GSS contexts required to
secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd
service is the server-side of RPCSEC GSS. If the system does not require secure
RPC then this service should be disabled.
The rpcsvcgssd service can be disabled with the following command:
$ sudo systemctl mask --now rpcsvcgssd.service
Rationale
Unnecessary services should be disabled to decrease the attack surface of the system.
- ID
- xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled
- Severity
- Unknown
- Updated
Remediation - Puppet
include disable_rpcsvcgssd
class disable_rpcsvcgssd {
service {'rpcsvcgssd':
enable => false,
ensure => 'stopped',
Remediation - Ansible
- name: Gather the package facts
package_facts:
manager: auto
tags:
- disable_strategy
- low_complexity
Remediation - script:kickstart
service disable rpcsvcgssd
Remediation - OS Build Blueprint
[customizations.services]
masked = ["rpcsvcgssd"]
Remediation - Kubernetes Patch
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
version: 3.1.0
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcsvcgssd.service'