Description
nfs-common provides the NFS client tools: the mount.nfs setuid helper, rpc.statd (NFSv3
locking), rpc.gssd and rpc.idmapd. It is only needed to mount NFS shares.
Not installed on Debian cloud images; often pulled in by full server installs. The NFS server and rpcbind are handled by CB-DEB-SVC-003.
Rationale
Unneeded software is extra code to patch. mount.nfs runs with root privileges, and
rpc.statd listens for RPC requests when it is started.
Impact
NFS shares can no longer be mounted. Removing nfs-common also removes nfs-kernel-server if it
is installed. Systems that mount NFS shares must exclude this control in their tailoring file.
Audit
Run dpkg-query -W -f='${Status}\n' nfs-common. It must not print install ok installed.
Automated: every check must pass. Scanners report each check by its id.
nfs-common
NFS client utilities.
name: nfs-common
state: absent
Remediation
Check that findmnt -t nfs,nfs4 lists nothing and that no NFS entry remains in /etc/fstab,
then run apt purge nfs-common.
| Restart | none |
| Disruption | low |
Rollback
Run apt install nfs-common.
nfs-common
Generated from check nfs-common: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- nfs(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R58 | partial | R58 asks to install only the packages that are strictly needed; this control covers nfs-common. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1210 |
Related controls
- related
CB-DEB-SVC-003Remove the NFS server and disable rpcbind when the system does not provide them
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Fresh image passes; with nfs-common installed the check fails, fix purges it (after CB-DEB-SVC-003 removed the NFS server), audit passes after reboot. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Fresh image passes; with nfs-common installed the check fails, fix purges it (after CB-DEB-SVC-003 removed the NFS server), audit passes after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |
