Description
nfs-common provides the NFS client tools: the mount.nfs setuid helper, rpc.statd (NFSv3
locking), rpc.gssd and rpc.idmapd. It is only needed to mount NFS shares.
Not installed on Ubuntu cloud images; often pulled in by full server installs or by autofs. The NFS server
and rpcbind are handled by CB-UBU-SVC-003.
Rationale
Unneeded software is extra code to patch. mount.nfs runs with root privileges, and
rpc.statd listens for RPC requests when it is started.
Impact
NFS shares can no longer be mounted. Removing nfs-common also removes nfs-kernel-server if it
is installed. Systems that mount NFS shares must exclude this control in their tailoring file.
Audit
Run dpkg-query -W -f='${Status}\n' nfs-common. It must not print install ok installed.
Automated: every check must pass. Scanners report each check by its id.
nfs-common
NFS client utilities.
name: nfs-common
state: absent
Remediation
Check that findmnt -t nfs,nfs4 lists nothing and that no NFS entry remains in /etc/fstab,
then run apt purge nfs-common.
| Restart | none |
| Disruption | low |
Rollback
Run apt install nfs-common.
nfs-common
Generated from check nfs-common: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- nfs(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R58) ANSSI, guide, accessed 2026-10-19
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R58 | partial | R58 asks to install only the packages that are strictly needed; this control covers nfs-common. |
| NIST SP 800-53 Rev. 55.1.1 | CM-7 | partial |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1210 |
Related controls
- related
CB-UBU-SVC-003Remove the NFS server and disable rpcbind when the system does not provide them
People and lifecycle
| Authors |
|
| Verified | 2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Stock image passes; with nfs-common installed the check fails, fix purges it (after CB-UBU-SVC-003 removed the NFS server), audit passes after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Stock image passes; with nfs-common installed the check fails, fix purges it (after CB-UBU-SVC-003 removed the NFS server), audit passes after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Stock image passes; with nfs-common installed the check fails, fix purges it (after CB-UBU-SVC-003 removed the NFS server), audit passes after reboot. |
| Verified | 2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Stock image passes; with nfs-common installed the check fails, fix purges it (after CB-UBU-SVC-003 removed the NFS server), audit passes after reboot. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-19, 2026-10-19 |
| Translations | fr |
