Uninstall nfs-utils Package
Removes the nfs-utils package (NFS server daemon and tools like showmount) when NFS is not needed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
On RHEL-family systems nfs-utils provides the kernel NFS server daemon and related tools, including showmount. showmount queries a remote host's mount daemon to enumerate its NFS exports and connected clients, useful to an attacker for reconnaissance. NFS also depends on the RPC stack, which exposes additional listening services with a history of vulnerabilities. If the system does not export NFS shares or act as an NFS server, removing the package reduces the remote attack surface.
What Pavois checks
Pavois queries the package database through the InSpec package('nfs-utils') resource and asserts should_not be_installed, resolving via rpm/dnf. The effective package inventory is the reliable signal: an empty /etc/exports or a stopped nfs-server does not prove NFS code is gone, since the daemons can be re-enabled while the package remains installed. On RHEL-family nfs-utils covers both server and many client utilities, so this is the canonical NFS package check.
describe package('nfs-utils') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q nfs-utils; expect package nfs-utils is not installed. Confirm no NFS service runs with systemctl status nfs-server (expect not-found) and nothing listens on ss -lntup | grep :2049.
Inspect & investigate
Removal is recorded in dnf history / rpm -q --last nfs-utils. Prior NFS server and mount activity appears in journalctl -u nfs-server and journalctl -u rpc-mountd. After removal those units should no longer exist.
Remediation
Pavois's harden plan declares a package resource for nfs-utils with action remove; pavois harden apply uninstalls it via dnf, which also stops the NFS server and related RPC daemons. Because nfs-utils on RHEL provides client tooling too, removing it also disables this host's ability to mount NFS shares, confirm that is acceptable.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | nfs-utils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing nfs-utils disables both serving and mounting NFS on this host; servers lose their exports and clients lose the ability to mount NFS shares. Precautions: before applying, check exportfs -v, /etc/exports and active mounts with findmnt -t nfs,nfs4. If the host serves or consumes NFS (e.g. shared application data, home directories), do not remove it. On hosts with no NFS role, removal is safe and reduces RPC/NFS exposure.