Skip to content

2.1.9 Ensure network file system services are not in use

Audit#

Run the following command to verify nfs-kernel-server is not installed: 

# dpkg-query -s nfs-kernel-server &>/dev/null && echo "nfs-kernel-server is installed"
Nothing should be returned.

- OR - - IF - package is required for dependencies: Run the following command to verify nfs-server.service is not enabled: 

# systemctl is-enabled nfs-server.service 2>/dev/null | grep 'enabled'
Nothing should be returned.

Run the following command to verify nfs-server.service is not active: 

# systemctl is-active nfs-server.service 2>/dev/null | grep '^active'
Nothing should be returned.

Note: If the package is required for a dependency - Ensure the dependent package is approved by local site policy - Ensure stopping and masking the service and/or socket meets local site policy

Remediation#

Run the following command to stop nfs-server.service and remove nfs-kernel-server package: 

# systemctl stop nfs-server.service
# apt purge nfs-kernel-server

- OR - - IF - the nfs-kernel-server package is required as a dependency: Run the following commands to stop and mask nfs-server.service: 

# systemctl stop nfs-server.service
# systemctl mask nfs-server.service