Remove the NFS server and disable rpcbind when the system does not provide them

Description

The NFS server (package nfs-kernel-server) exports local directories over NFS. rpcbind maps ONC RPC program numbers to ports; it listens on port 111 through rpcbind.socket and rpcbind.service, and is needed by NFSv3 and NIS.

The control requires nfs-kernel-server to be absent, and the rpcbind units to be masked or not installed at all.

The NFS server is removed rather than masked: its maintainer scripts manage the unit through the nfs-kernel-server.service alias, and with nfs-server.service masked, removing or upgrading the package fails (tested on Debian 12 and 13). A rpcbind unit that does not exist counts as compliant. The NFS client package nfs-common is handled by CB-DEB-SVC-027 in the hardened server profile.

Rationale

NFS trusts client addresses and user IDs, so a misconfigured export gives remote access to files. rpcbind tells any host which RPC services run, and has been abused for traffic amplification and remote code execution.

Impact

Removing the NFS server stops every export. Masking rpcbind breaks NFSv3 client mounts and file locking (rpc.statd) and NIS. NFSv4 mounts do not need it. NFS servers, and clients that still mount NFSv3 shares, must exclude this control in their tailoring file.

Audit

1. dpkg-query -W -f='${Status}\n' nfs-kernel-server must not print install ok installed.
2. systemctl is-enabled rpcbind.service rpcbind.socket must print masked, or fail because the units do not exist.

Automated: every check must pass. Scanners report each check by its id.

nfs-server

NFS kernel server package.

name: nfs-kernel-server
state: absent

rpcbind

rpcbind service.

unit: rpcbind.service
state: masked

rpcbind-socket

rpcbind socket activation.

unit: rpcbind.socket
state: masked

Remediation

Run apt purge nfs-kernel-server, then systemctl mask --now rpcbind.socket rpcbind.service (or apt purge rpcbind if nothing depends on it).

Rollback

Run systemctl unmask rpcbind.socket rpcbind.service, systemctl enable --now rpcbind.socket, and reinstall the NFS server with apt install nfs-kernel-server.

nfs-server

Generated from check nfs-server: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rpcbind-socket

Generated from check rpcbind-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

rpcbind

Generated from check rpcbind: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• rpcbind(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• nfsd(8), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• systemctl(1), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R62) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-SVC-027 Remove the NFS client utilities when no NFS share is mounted

People and lifecycle