Skip to content
Log In

Disable Network File Systems (netfs)

An XCCDF Rule

Description

The netfs script manages the boot-time mounting of several types of networked filesystems, of which NFS and Samba are the most common. If these filesystem types are not in use, the script can be disabled, protecting the system somewhat against accidental or malicious changes to /etc/fstab and against flaws in the netfs script itself. The netfs service can be disabled with the following command: 
$ sudo systemctl mask --now netfs.service
ID
xccdf_org.ssgproject.content_rule_service_netfs_disabled
Severity
Unknown
Updated

Remediation Templates

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'netfs.service'
"$SYSTEMCTL_EXEC" disable 'netfs.service'
"$SYSTEMCTL_EXEC" mask 'netfs.service'

A Puppet Snippet

include disable_netfs
class disable_netfs {
  service {'netfs':
    enable => false,
    ensure => 'stopped',
  }
}

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - disable_strategy
  - low_complexity

OS Build Blueprint

[customizations.services]
masked = ["netfs"]