Disable rpcbind Service
Ensures the rpcbind.service (ONC RPC port mapper) is neither enabled at boot nor running, unless the host genuinely needs RPC services such as NFS.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
rpcbind is the port mapper for ONC RPC services (NFSv3, NIS, rquotad…): it listens on TCP/UDP 111 and tells remote clients which dynamic ports those services use. It is a well-known target, it has been abused for UDP reflection/amplification DDoS and historically carried RPC vulnerabilities, and it leaks the set of RPC services running on the host. On any system that is not an NFSv3/NIS client or server, rpcbind is dead weight that needlessly exposes port 111 to the network. Disabling it shrinks the attack surface and removes a common amplification vector.
What Pavois checks
Pavois reads the effective state of rpcbind.service from systemd, checking it is neither enabled nor running. Crucially, rpcbind is socket-activated: rpcbind.socket can pull the daemon up on demand even when the service unit looks idle. Auditing the live systemd state (rather than a config file or a package check) reflects what is actually listening on port 111. Pair with ss -lnp | grep :111 to confirm nothing is bound.
describe service('rpcbind.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled rpcbind.service and systemctl is-active rpcbind.service; expect disabled/masked and inactive. Also check the socket: systemctl is-active rpcbind.socket and ss -lnp | grep :111 (should return nothing).
Inspect & investigate
Inspect journalctl -u rpcbind.service -u rpcbind.socket for activation and stop events. systemctl show rpcbind.service -p ActiveState -p UnitFileState gives the machine-readable state. Confirm the port is closed with ss -tulnp | grep :111.
Remediation
Pavois's harden plan acts on the service resource named rpcbind with actions disable then stop: it removes boot enablement and stops the running daemon. Applied with pavois harden apply. Note: if rpcbind.socket is also active you may need to mask it as well to fully close port 111.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | rpcbind |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling rpcbind will break NFSv3, NIS, and any RPC-dependent service (rquotad, rpc.statd, some backup agents). NFSv4 does not need rpcbind, so pure NFSv4 mounts are unaffected. Before applying: confirm there are no NFSv3 mounts (findmnt -t nfs,nfs3), no NFS exports (exportfs -v), and no NIS client config. If the host is an NFSv3 client/server, exclude this rule or migrate to NFSv4 first to avoid mount failures.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.12, 2.2.4 | direct | per OS, see the benchmark table | high |
| PCI DSS | 2.2.4 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.