Uninstall ypserv Package
Ensures the insecure NIS server package ypserv is not installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ypserv is the NIS (Network Information Service) server daemon. NIS provides an unencrypted authentication service that protects neither the confidentiality nor the integrity of user passwords or the remote session, and has a history of DoS and buffer-overflow vulnerabilities. Removing the ypserv package decreases the risk of accidental or intentional activation of NIS/NIS+ and removes a high-value attack surface; modern deployments should use LDAP instead.
What Pavois checks
Pavois queries the package database via the InSpec package('ypserv') resource (rpm -q / dpkg -s). Checking the package guarantees the NIS server cannot be started to serve unencrypted credential maps; if the package is gone, the ypserv service unit no longer exists.
describe package('ypserv') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family: rpm -q ypserv → package ypserv is not installed. On Debian/Ubuntu: dpkg -s ypserv → dpkg-query: package 'ypserv' is not installed. You can also confirm nothing serves NIS with ss -lunp | grep ypserv returning no rows.
Inspect & investigate
- Package state:
rpm -q ypserv/dpkg -s ypserv; removal in/var/log/dnf.rpm.logor/var/log/dpkg.log. - Past NIS server activity (before removal):
journalctl -u ypserv.
Remediation
Pavois's harden plan declares a package resource for ypserv with action remove, so pavois harden apply uninstalls it (dnf remove ypserv / apt-get purge ypserv). Removing the package also removes the ypserv unit, so no restart is needed.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | ypserv |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If ypserv stays installed, this host can serve an unencrypted NIS directory exposing password maps to the network. Before applying: confirm this machine is not an active NIS master/slave serving other hosts, check systemctl is-enabled ypserv and whether clients bind to it (ss -lunp | grep ypserv). If it is a live NIS server, migrate the NIS clients to LDAP/SSSD before removing it, otherwise those clients lose directory/authentication and may lock out. Removal does not affect this host's own SSH access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R62 | direct | 2.0 | high |
| CIS | 2.1.10, 2.2.4 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b), IA-5(1)(c) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.