Description
The rpcbind utility maps RPC services to the ports on which they listen.
RPC processes notify rpcbind when they start, registering the ports they
are listening on and the RPC program numbers they expect to serve. The
rpcbind service redirects the client to the proper port number so it can
communicate with the requested service. If the system does not require RPC
(such as for NFS servers) then this service should be disabled.
The rpcbind service can be disabled with the following command:
$ sudo systemctl mask --now rpcbind.service
Rationale
If the system does not require rpc based services, it is recommended that
rpcbind be disabled to reduce the attack surface.
Shell script
The following script can be run on the host to remediate the issue.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL\_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL\_EXEC" stop 'rpcbind.service'
"$SYSTEMCTL\_EXEC" disable 'rpcbind.service'
"$SYSTEMCTL\_EXEC" mask 'rpcbind.service'
# Disable socket activation if we have a unit file for it
if "$SYSTEMCTL\_EXEC" -q list-unit-files rpcbind.socket; then
"$SYSTEMCTL\_EXEC" stop 'rpcbind.socket'
"$SYSTEMCTL\_EXEC" mask 'rpcbind.socket'
fi
# The service may not be running because it has been started and failed,
# so let's reset the state so OVAL checks pass.
# Service should be 'inactive', not 'failed' after reboot though.
"$SYSTEMCTL\_EXEC" reset-failed 'rpcbind.service' || true
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Ansible playbook
The following playbook can be run with Ansible to remediate the issue.
- name: Block Disable service rpcbind
block:
- name: Disable service rpcbind
block:
- name: Disable service rpcbind
systemd:
name: rpcbind.service
enabled: 'no'
state: stopped
masked: 'yes'
rescue:
- name: Intentionally ignored previous 'Disable service rpcbind' failure, service
was already disabled
meta: noop
when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-80230-6
- PCI-DSSv4-2.2.4
- disable\_strategy
- low\_complexity
- low\_disruption
- low\_severity
- no\_reboot\_needed
- service\_rpcbind\_disabled
- name: Unit Socket Exists - rpcbind.socket
command: systemctl list-unit-files rpcbind.socket
register: socket\_file\_exists
changed\_when: false
failed\_when: socket\_file\_exists.rc not in [0, 1]
check\_mode: false
when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-80230-6
- PCI-DSSv4-2.2.4
- disable\_strategy
- low\_complexity
- low\_disruption
- low\_severity
- no\_reboot\_needed
- service\_rpcbind\_disabled
- name: Disable socket rpcbind
systemd:
name: rpcbind.socket
enabled: 'no'
state: stopped
masked: 'yes'
when:
- ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
- '"rpcbind.socket" in socket\_file\_exists.stdout\_lines[1]'
tags:
- CCE-80230-6
- PCI-DSSv4-2.2.4
- disable\_strategy
- low\_complexity
- low\_disruption
- low\_severity
- no\_reboot\_needed
- service\_rpcbind\_disabled
