Remove NIS Client
Ensures the insecure NIS client package ypbind is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ypbind is the NIS (Network Information Service) client daemon. NIS is inherently insecure: it has been vulnerable to denial-of-service attacks and buffer overflows, and provides weak authentication when querying NIS maps, which it transmits without encryption. NIS has been superseded by protocols such as LDAP. The client package should be removed so the host cannot bind to a NIS domain and leak directory/credential data.
What Pavois checks
Pavois queries the package database via the InSpec package('ypbind') resource (rpm -q). Checking the package guarantees the NIS client cannot be started to bind the host to a NIS domain; if the package is gone, the ypbind service unit no longer exists.
describe package('ypbind') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q ypbind. Expected output: package ypbind is not installed. You can also confirm systemctl status ypbind returns Unit ypbind.service could not be found.
Inspect & investigate
- Package state:
rpm -q ypbind; removal recorded in/var/log/dnf.rpm.log. - Past NIS binding activity (before removal):
journalctl -u ypbindandypwhich(which NIS server was bound).
Remediation
Pavois's harden plan declares a package resource for ypbind with action remove, so pavois harden apply uninstalls it (dnf remove ypbind). Removing the package also removes the ypbind unit, so no restart is needed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | ypbind |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If ypbind stays installed, the host can bind to a NIS domain and rely on an unencrypted, weakly-authenticated directory service for users/credentials. Before applying: confirm the host does not actually authenticate users or resolve maps via NIS, check /etc/nsswitch.conf for nis entries and ypwhich. If NIS is still in use for login, migrate to LDAP/SSSD first, otherwise removing the client can break user authentication and lock out accounts that resolve only through NIS. Removal does not affect existing SSH key-based access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
| CIS | 2.2.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.