Profile Applicability:
 • Level 1

Description:
 Network File System (NFS) services allow file sharing over the network. If the system is not intended to provide NFS services, these should be disabled to reduce the system’s attack surface and prevent unauthorized file sharing.

Rationale:
 Disabling unused NFS services minimizes exposure to network-based attacks and prevents unauthorized access to shared files.

Impact:
 Pros:

  • Reduces risk of unauthorized file access over the network.

  • Limits unnecessary services running on the system.

Cons:

  • Disabling NFS on systems that require it may disrupt legitimate file sharing.

Default Value:
 NFS services may be enabled by default on some systems.

Pre-requisites:

  • Root or sudo privileges to manage system services.

Remediation:

Test Plan:

Using Linux command line:

1. Check if NFS server services are enabled:

systemctl is-enabled nfs-server  
systemctl is-enabled nfs

2. Check if NFS server services are running:

systemctl status nfs-server  
systemctl status nfs

Implementation Plan:

Using Linux command line:

1. Disable NFS server services:

systemctl disable nfs-server  
systemctl disable nfs

2. Stop running NFS server services:

systemctl stop nfs-server  
systemctl stop nfs

3. Verify services are disabled and stopped:

systemctl is-enabled nfs-server  
systemctl is-enabled nfs  
systemctl status nfs-server  
systemctl status nfs

Backout Plan:

Using Linux command line:

1. Enable and start NFS server services if required:

systemctl enable nfs-server  
systemctl start nfs-server  
systemctl enable nfs  
systemctl start nfs

2. Verify service status.

References:

  • CIS Amazon Linux 2 Benchmark v3.0.0

  • Systemd Service Management