0091-rpcbind-uninstalled¶

Rule ID¶

• 0091-rpcbind-uninstalled

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• The rpcbind utility maps RPC services to the ports they listen on. RPC processes notify rpcbind when they start, registering the port they are listening on and the RPC program number they intend to serve. Client systems then contact rpcbind on the server with a specific RPC program number. The rpcbind service redirects the client to the correct port number so that it can communicate with the requested service.

  Portmapper is an RPC service that always listens on TCP and UDP port 111 and is used to map other RPC services (such as nfs, nlockmgr, quotad, mountd, etc.) to their corresponding port numbers on the server. When a remote host makes an RPC call to that server, it first consults portmap to determine where the RPC server is listening.

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Small requests (~82 bytes) sent to the portmapper generate large responses (7x to 28x amplification), making it a suitable tool for DDoS attacks. If rpcbind is not required, it is recommended to remove the rpcbind package to reduce the system's attack surface.

  Note: Many libvirt packages used by enterprise Linux virtualization and the nfs-utils package used by the Network File System (NFS) depend on the rpcbind package. If rpcbind is required as a dependency, the services rpcbind.service and rpcbind.socket should be stopped and masked to reduce the system's attack surface.

Risk Items¶

• Increased risk of attack

Audit Method¶

• Run the following command to verify that the corresponding component is not installed:

  # rpm -q rpcbind
  package rpcbind is not installed
  

  If the corresponding package is needed as a dependency, run the following command to verify that the risky service is masked:

  # systemctl is-enabled rpcbind
  masked
  # systemctl is-enabled rpcbind.socket
  masked
  

Remediation¶

• Run the following command to remove the corresponding package:

  # yum remove rpcbind
  

  If the corresponding package is needed as a dependency, run the following command to stop and mask the risky service:

  # systemctl --now mask rpcbind
  # systemctl --now mask rpcbind.socket
  

Impact¶

• Processes that depend on this component may behave abnormally.

Default Value¶

• None

References¶

• None

CIS Controls¶

• Version 7

  9.2 Ensure Only Approved Ports, Protocols, and Services Are Running
  Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.