← All rules
SOCLE-RUN-SVC-040// systemd servicesmediumeffective runtime

Disable ypserv Service

Ensures the ypserv (NIS/NIS+ directory) service is stopped and disabled so the host does not run a legacy directory server.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

ypserv is the server for NIS (Network Information Service, formerly Yellow Pages), a legacy directory protocol that distributes user accounts, passwords and host maps over the network without encryption or strong authentication. Anyone on the network can query the maps and harvest password hashes, and the protocol is trivially spoofable. Unless the host is an actively-used NIS master, this service must be disabled to remove an obsolete and dangerous attack surface.

What Pavois checks

Pavois asks systemd for the resolved state of the unit (systemctl is-enabled ypserv.service / is-active), not the presence of a config file. A unit can be masked, statically enabled, or pulled in by a socket or a target; only the effective state reported by systemd tells you whether it will actually start.

describe service('ypserv.service') do
  it { should_not be_enabled }
  it { should_not be_running }
end

How to verify it is applied

Run systemctl is-enabled ypserv.service and systemctl is-active ypserv.service. Expected output is disabled (or masked/not-found) and inactive. You can also confirm the package is gone with dpkg -l nis ypserv 2>/dev/null.

Inspect & investigate

Inspect the unit lifecycle with journalctl -u ypserv.service and its current properties with systemctl show ypserv.service. Any past activity (binding to port 111/RPC) appears in the journal.

Remediation

Pavois's harden plan targets the ypserv service and applies the actions stop then disable, so the unit is both halted immediately and prevented from starting at boot. Apply it with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actiondisable, stop
nameypserv
resourceservice
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Disabling ypserv is safe on any host that is not an NIS master. Before applying, confirm no clients rely on this machine for NIS maps: check ypwhich/ypcat usage on dependent hosts and grep for nis in /etc/nsswitch.conf on clients. If the host legitimately serves NIS, migrate clients to LDAP/Kerberos or SSSD first, otherwise dependent logins and host resolution will break.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS2.1.10directper OS, see the benchmark tablehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references