Disable RDS Support
Ensures the rds (Reliable Datagram Sockets) network protocol kernel module cannot be loaded.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
RDS (Reliable Datagram Sockets) is a specialized transport protocol designed for high-performance/HPC and InfiniBand clusters. It is rarely needed and its kernel implementation has a history of serious vulnerabilities (including a local root flaw, CVE-2010-3904). Disabling RDS protects the system against exploitation of any flaws in its implementation and removes an unused network protocol from the attack surface.
What Pavois checks
Pavois uses the InSpec kernel_module('rds') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not a static grep of /etc/modprobe.d/, so an application or drop-in that autoloads the protocol is detected.
describe kernel_module('rds') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v rds, it should print install /bin/true. Confirm it is not loaded with lsmod | grep rds (no output expected). modprobe --showconfig | grep rds should show a blacklist rds and an install rds /bin/true line.
Inspect & investigate
Load attempts appear in the kernel ring buffer: dmesg | grep rds or journalctl -k | grep rds. The effective modprobe policy is shown by modprobe --showconfig | grep rds.
Remediation
pavois harden apply uses the kernel_module resource to blacklist rds: it writes a drop-in under /etc/modprobe.d/ with blacklist rds and install rds /bin/true, and unloads the module if loaded. Because the protocol may already be loaded, reboot_required is true to guarantee a clean state.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | rds |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a niche network protocol with a history of kernel CVEs remains loadable and reachable.
- Before applying, confirm no application uses RDS sockets, relevant only to specific HPC/InfiniBand or Oracle RAC interconnect workloads.
- Non-disruptive on general-purpose servers and VMs.
- A reboot is required for full effect; schedule it in a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 3.2.3, 3.2.5, 3.2.4 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.