Skip to content
Log In

Disable Secure RPC Client Service (rpcgssd)

An XCCDF Rule

Description

The rpcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcgssd service is the client-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. The rpcgssd service can be disabled with the following command: 
$ sudo systemctl mask --now rpcgssd.service
ID
xccdf_org.ssgproject.content_rule_service_rpcgssd_disabled
Severity
Unknown
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

OS Build Blueprint

[customizations.services]
disabled = ["rpcgssd"]

A Puppet Snippet

include disable_rpcgssd
class disable_rpcgssd {
  service {'rpcgssd':
    enable => false,
    ensure => 'stopped',
  }
}

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcgssd.service'

An Ansible Snippet

- name: Block Disable service rpcgssd
  block:
  - name: Disable service rpcgssd
    block:

    - name: Disable service rpcgssd