Uninstall nfs-kernel-server Package
Removes the nfs-kernel-server package (the NFS server) when the host does not need to export NFS shares.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The nfs-kernel-server package provides the in-kernel NFS server (nfsd, rpc.mountd, exports), turning the host into an NFS file server. It exposes the RPC/portmapper stack and NFS daemons on the network, a historically vulnerable surface. If the system does not need to export NFS shares, removing the package eliminates these listening services and reduces the remote attack surface.
What Pavois checks
Pavois queries the package database through the InSpec package('nfs-kernel-server') resource and asserts should_not be_installed, resolving via dpkg. The effective package inventory is more reliable than inspecting /etc/exports: an empty exports file does not prove the server is gone, and the daemons can be re-enabled while installed. The package state definitively tells whether NFS server code is present.
describe package('nfs-kernel-server') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s nfs-kernel-server; expect not installed. Confirm nothing is exported with exportfs -v (command should be absent or print nothing) and no nfsd listener via ss -lntup | grep :2049 (no output expected).
Inspect & investigate
Removal is recorded in /var/log/dpkg.log. Prior NFS server activity, mount requests and export errors appear in journalctl -u nfs-server and journalctl -u rpc-mountd. After removal those units should no longer exist.
Remediation
Pavois's harden plan declares a package resource for nfs-kernel-server with action remove; pavois harden apply uninstalls it via apt, which stops nfs-server and the associated RPC daemons. Removing the server package does not remove client support (nfs-common); that is a separate rule.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | nfs-kernel-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing nfs-kernel-server stops this host from serving NFS; any clients mounting its exports will lose access. Precautions: before applying, check /etc/exports and exportfs -v, if this host is a file server other systems depend on, do not remove it (or migrate those shares first). Notify clients of the outage. On hosts that never exported NFS, removal is safe and shrinks the network attack surface.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.9 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-215040, UBTU-24-100050 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.