Disable Network File System (nfs)

Classification:

compliance

Framework:

Control:

Description

The Network File System (NFS) service allows remote hosts to mount and interact with shared filesystems on the local system. If the local system is not designated as a NFS server then this service should be disabled.

The nfs-server service can be disabled with the following command:

$ sudo systemctl mask --now nfs-server.service

Rationale

Unnecessary services should be disabled to decrease the attack surface of the system.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'nfs-server.service'
"$SYSTEMCTL\_EXEC" disable 'nfs-server.service'
"$SYSTEMCTL\_EXEC" mask 'nfs-server.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL\_EXEC" -q list-unit-files nfs-server.socket; then
 "$SYSTEMCTL\_EXEC" stop 'nfs-server.socket'
 "$SYSTEMCTL\_EXEC" mask 'nfs-server.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'nfs-server.service' || true

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Block Disable service nfs-server
 block:

 - name: Disable service nfs-server
 block:

 - name: Disable service nfs-server
 systemd:
 name: nfs-server.service
 enabled: 'no'
 state: stopped
 masked: 'yes'
 rescue:

 - name: Intentionally ignored previous 'Disable service nfs-server' failure, service
 was already disabled
 meta: noop
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-82762-6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - no\_reboot\_needed
 - service\_nfs\_disabled
 - unknown\_severity

- name: Unit Socket Exists - nfs-server.socket
 command: systemctl list-unit-files nfs-server.socket
 register: socket\_file\_exists
 changed\_when: false
 failed\_when: socket\_file\_exists.rc not in [0, 1]
 check\_mode: false
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-82762-6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - no\_reboot\_needed
 - service\_nfs\_disabled
 - unknown\_severity

- name: Disable socket nfs-server
 systemd:
 name: nfs-server.socket
 enabled: 'no'
 state: stopped
 masked: 'yes'
 when:
 - ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - '"nfs-server.socket" in socket\_file\_exists.stdout\_lines[1]'
 tags:
 - CCE-82762-6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - low\_complexity
 - low\_disruption
 - no\_reboot\_needed
 - service\_nfs\_disabled
 - unknown\_severity