Uninstall the nis package
Ensures the legacy nis (Network Information Service) package is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
NIS is SUN's historical service for centralized account management, now superseded by LDAP and SSSD. It transmits credentials and account maps in clear text, has no transport authentication, and cannot enforce modern access controls (ACLs, password policies). A running NIS client or server widely expands the attack surface and can leak the passwd/shadow maps to anyone on the network. Removing the package eliminates this risk entirely.
What Pavois checks
Pavois asks the package manager whether nis is installed via the InSpec package resource (effectively dpkg-query -W nis). Querying installed-package state directly reflects what is actually present on the system, rather than relying on a config file or a guessed service name that may not match the real binary set.
describe package('nis') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg-query -W -f='${Status}\n' nis. The expected output is dpkg-query: no packages found matching nis (or a status that does not contain install ok installed).
Inspect & investigate
dpkg-query -W nis, confirms the package is absent.journalctl -u ypbind/journalctl -u nis, should report no such unit, proving the NIS client/server is not running.
Remediation
Pavois's harden plan declares a package resource for nis with action remove and applies it with pavois harden apply, which runs apt-get remove nis under the hood. No reinstall or service restart is needed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | nis |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing nis is safe on systems that authenticate locally or via LDAP/SSSD. Precaution: if accounts are still served by NIS, removing it will break login and name resolution for those users, migrate to LDAP/SSSD first and confirm local admin access (a root or sudo account in /etc/passwd) before applying, to avoid lockout.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.