Uninstall nfs-common Package
Removes the nfs-common package (NFS client support) when the host does not mount or serve NFS shares.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The nfs-common package provides the client-side NFS support (rpc.statd, rpc.gssd, mount.nfs helpers) needed to mount remote NFS shares. NFS relies on the RPC/portmapper stack, which has a long history of vulnerabilities and exposes additional listening services. If the system neither mounts NFS shares nor acts as an NFS client, removing the package reduces the remote attack surface and eliminates unnecessary RPC daemons.
What Pavois checks
Pavois queries the package database through the InSpec package('nfs-common') resource and asserts should_not be_installed, resolving via dpkg. Reading the effective package inventory is more reliable than checking for active NFS mounts with findmnt: a host can have the client stack installed and ready to mount even with no mount currently active, so the package state is the definitive indicator that NFS client code is absent.
describe package('nfs-common') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s nfs-common; expect not installed (or dpkg-query: package 'nfs-common' is not installed). Confirm no NFS mounts remain with findmnt -t nfs,nfs4 (no output expected) and no RPC daemons with ss -lntup | grep -E ':111|rpc'.
Inspect & investigate
Removal is recorded in /var/log/dpkg.log. Prior NFS client activity (statd, lock recovery) appears in journalctl -u rpc-statd and the kernel log (dmesg). After removal, those units should no longer exist.
Remediation
Pavois's harden plan declares a package resource for nfs-common with action remove; pavois harden apply uninstalls it via apt, which also stops the associated RPC client daemons. Be aware many desktop and integration metapackages depend on nfs-common, so apt may remove or block on those, review the apt transaction before applying on a non-server host.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | nfs-common |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing nfs-common disables this host's ability to mount NFS shares; any application or fstab entry relying on an NFS mount will fail. Precautions: before applying, run findmnt -t nfs,nfs4 and check /etc/fstab for NFS entries, if the host depends on NFS (e.g. shared home directories), do not remove it. Also verify no metapackage you need will be pulled out by the apt removal. On hosts that never use NFS, removal is safe and reduces RPC exposure.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-215040 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.