Skip to content
Log In

Disable Secure RPC Server Service (rpcsvcgssd)

An XCCDF Rule

Description

The rpcsvcgssd service manages RPCSEC GSS contexts required to secure protocols that use RPC (most often Kerberos and NFS). The rpcsvcgssd service is the server-side of RPCSEC GSS. If the system does not require secure RPC then this service should be disabled. The rpcsvcgssd service can be disabled with the following command: 
$ sudo systemctl mask --now rpcsvcgssd.service

Rationale

Unnecessary services should be disabled to decrease the attack surface of the system.

ID
xccdf_org.ssgproject.content_rule_service_rpcsvcgssd_disabled
Severity
Unknown
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

OS Build Blueprint

[customizations.services]
disabled = ["rpcsvcgssd"]

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" disable 'rpcsvcgssd.service'
"$SYSTEMCTL_EXEC" mask 'rpcsvcgssd.service'

An Ansible Snippet

- name: Block Disable service rpcsvcgssd
  block:
  - name: Disable service rpcsvcgssd
    block:

    - name: Disable service rpcsvcgssd

A Puppet Snippet

include disable_rpcsvcgssd
class disable_rpcsvcgssd {
  service {'rpcsvcgssd':
    enable => false,
    ensure => 'stopped',
  }
}