Uninstall rpcbind Package
Ensures the rpcbind portmapper package is not installed when no RPC-based services are needed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
rpcbind is the portmapper that maps ONC RPC program numbers to network ports for services such as NFSv3 and NIS. It listens on TCP/UDP port 111 and has historically been abused for UDP amplification DDoS and information disclosure. If the system does not provide RPC-based services, removing rpcbind eliminates an unnecessary network listener and reduces the attack surface.
What Pavois checks
Pavois checks the effective package state with package('rpcbind') and expects it absent (should_not be_installed), resolved through dpkg-query. Confirming the package is gone is stronger than checking a masked unit or a firewall rule: a present-but-stopped rpcbind can be restarted by a dependency (e.g. installing an NFS client) and reopen port 111.
describe package('rpcbind') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg-query -W -f='${Status}\n' rpcbind. Expected: no packages found matching rpcbind (non-zero exit). Confirm nothing listens on port 111 with ss -lntu | grep ':111' (should return nothing).
Inspect & investigate
Package removal is recorded in /var/log/dpkg.log (grep rpcbind /var/log/dpkg.log). Prior rpcbind/portmapper activity and any blocked connection attempts to port 111 appear in /var/log/syslog and journalctl -u rpcbind.
Remediation
Pavois's harden plan removes the rpcbind package via the package resource (action: remove). It is applied with pavois harden apply. Removing it also closes the port-111 listener that rpcbind opened.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | rpcbind |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing rpcbind breaks any service that depends on the RPC portmapper, most notably NFSv3 (server and client) and NIS. - Before removing, confirm this host is not an NFSv3 server/client or NIS participant (NFSv4 does not need rpcbind). - Check current consumers with rpcinfo -p and ss -lntu | grep ':111'; if NFSv3 is required, do not remove the package and instead restrict access to port 111 by firewall.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.12 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.