Disable ypserv Service
Ensures the ypserv (NIS/NIS+ directory) service is stopped and disabled so the host does not run a legacy directory server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
ypserv is the server for NIS (Network Information Service, formerly Yellow Pages), a legacy directory protocol that distributes user accounts, passwords and host maps over the network without encryption or strong authentication. Anyone on the network can query the maps and harvest password hashes, and the protocol is trivially spoofable. Unless the host is an actively-used NIS master, this service must be disabled to remove an obsolete and dangerous attack surface.
What Pavois checks
Pavois asks systemd for the resolved state of the unit (systemctl is-enabled ypserv.service / is-active), not the presence of a config file. A unit can be masked, statically enabled, or pulled in by a socket or a target; only the effective state reported by systemd tells you whether it will actually start.
describe service('ypserv.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled ypserv.service and systemctl is-active ypserv.service. Expected output is disabled (or masked/not-found) and inactive. You can also confirm the package is gone with dpkg -l nis ypserv 2>/dev/null.
Inspect & investigate
Inspect the unit lifecycle with journalctl -u ypserv.service and its current properties with systemctl show ypserv.service. Any past activity (binding to port 111/RPC) appears in the journal.
Remediation
Pavois's harden plan targets the ypserv service and applies the actions stop then disable, so the unit is both halted immediately and prevented from starting at boot. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | ypserv |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling ypserv is safe on any host that is not an NIS master. Before applying, confirm no clients rely on this machine for NIS maps: check ypwhich/ypcat usage on dependent hosts and grep for nis in /etc/nsswitch.conf on clients. If the host legitimately serves NIS, migrate clients to LDAP/Kerberos or SSSD first, otherwise dependent logins and host resolution will break.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.10 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.