Disable Network File System (nfs)
Ensures the NFS server (nfs-server.service) is disabled and not running unless the host is an intentional file server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The NFS server (nfs-server.service) exports file systems over the network and depends on RPC services that broaden the attack surface. Unless the host is an intended file server, it should be disabled to reduce exposure.
What Pavois checks
Pavois queries the resolved unit state with systemctl is-enabled / is-active for nfs-server.service. The effective state catches a server enabled via a drop-in or socket activation that scanning /etc/exports and /etc/nfs.conf files would miss.
describe service('nfs-server.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled nfs-server.service (expected disabled or not-found) and systemctl is-active nfs-server.service (expected inactive).
Inspect & investigate
Check systemctl show nfs-server.service (fields UnitFileState, ActiveState) and journalctl -u nfs-server.service; active exports are listed by exportfs -v and showmount -e localhost.
Remediation
Pavois's harden plan applies a service resource for nfs with actions disable and stop, so the NFS server stays off across reboots and is stopped immediately. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | nfs-server.service |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
On a host that is not a file server, disabling nfs-server.service has no functional impact. Precaution: if other systems mount exports from this machine, do not disable it, those clients would lose access to their shared storage (and may hang on stale mounts); document the exception instead. Disabling the server does not affect this host acting as an NFS client.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.9 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-24-100050 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.