0100-ypserv-uninstalled - NIS Service Installed
Rule ID
Category
Level
Compatible Versions
Description
- The NIS service is inherently an insecure system, vulnerable to DOS attacks, buffer overflows, and poor authentication when querying NIS maps. NIS has typically been replaced by protocols such as Lightweight Directory Access Protocol (LDAP). It is recommended to remove the ypserv package if a more secure service is required.
Scan Frequency
Rationale
- The ypserv package provides the NIS (Network Information Service) service. This service, formally known as Yellow Pages, is a client-server directory service protocol for distributing system configuration files. The NIS server is a collection of programs that allow the distribution of configuration files.
Risk Items
- Hacker Infiltration
- Data Leakage
- Network Security
- Cryptomining Risk
- Botnet Risk
Audit Method
- Execute the following command to verify whether ypserv is installed.
# rpm -q ypserv
package ypserv is not installed
- Run the command to remove ypserv.
Impact
Default Value
References
CIS Controls
- Version 7
9.2 Ensure Only Approved Ports, Protocols, and Services Are Running
Ensure only network ports, protocols, and services listening on a system with validated business needs are running on each system.