---
title: "HOST-SVC-008 NFS Server or rpcbind Installed or Enabled"
canonical: https://openvapt.com/checks/HOST-SVC-008.html
html: https://openvapt.com/checks/HOST-SVC-008.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SVC-008 NFS Server or rpcbind Installed or Enabled

Checks whether the NFS server or the RPC port mapper (rpcbind) is installed or enabled.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188, CWE-306
- NIST SP 800-53 Rev. 5: CM-7, CM-7(1)
- Benchmark topic: NFS and rpcbind are not installed unless required (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

NFS exports whole directory trees with trust based on client IP address and numeric user ids, and rpcbind tells any caller which RPC services are running. Unless this machine is a file server, both are attack surface with no benefit. The rpcbind package is often pulled in as a dependency and left running. If this machine is one of the file servers that legitimately run it, record the reason in the suppression file so the finding stays visible but accepted.

## How It Detects

Reads installed packages from /var/lib/dpkg/status (only entries marked 'install ok installed'; /var/lib/dpkg/info/*.list is a fallback used only when the status file cannot be read) and the allow-listed rpm -qa, and looks for nfs-kernel-server, rpcbind. Reads the *.wants links under /etc/systemd/system (and asks the allow-listed systemctl is-enabled) for nfs-server.service, rpcbind.service, rpcbind.socket, nfs-kernel-server.service. Either an installed package or an enabled unit fails. Incomplete when no package database and no systemd unit directory could be read.

## How to Fix

apt purge nfs-kernel-server rpcbind  or  dnf remove nfs-utils rpcbind  where NFS is not served, and  systemctl disable --now nfs-server rpcbind.socket rpcbind.service . Where NFS is required, export read-only with root_squash to named hosts and firewall port 2049 and 111. Before removing a package, check that no application on this machine or the network still uses the service, and keep console access when the service is remote-access related.

## How to Verify

```
dpkg -l nfs-kernel-server rpcbind 2>/dev/null | grep '^ii' ; systemctl is-enabled nfs-server.service rpcbind.service rpcbind.socket nfs-kernel-server.service 2>/dev/null
```

## Learn the Theory

- [P1 Linux Server Hardening](https://openvapt.com/academy/p1.md)
- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [NFS security, Linux kernel documentation (exports and rpcbind)](https://docs.kernel.org/filesystems/nfs/index.html)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/legacy_services.go

Run it: `openvapt scan --only HOST-SVC-008`. Read it offline: `openvapt explain HOST-SVC-008`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SVC-008.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.