0102-ypbind-uninstalled - NIS Client Installed
Rule ID
Category
Level
Compatible Versions
Description
- Network Information Service (NIS), formerly known as Yellow Pages, is a client-server directory service protocol used to distribute system configuration files. The NIS client (ypbind) is used to bind a machine to an NIS server and receive distributed configuration files.
Scan Frequency
Rationale
- The NIS service is inherently insecure, vulnerable to DOS attacks, buffer overflows, and offers poor authentication when querying NIS maps. NIS has generally been replaced by protocols such as the Lightweight Directory Access Protocol (LDAP). It is recommended to remove this service.
Risk Items
- Hacker Penetration
- Data Leakage
- Network Security
- Mining Risk
- Bot Risk
Audit Method
- Execute the following command to verify whether ypbind is installed.
# rpm -q ypbind
package ypbind is not installed
- Run the command to remove ypbind.
Impact
- Many insecure service clients are used as troubleshooting tools and in test environments. Removing them may suppress testing and troubleshooting capabilities. If they are required, it is advisable to remove the client after use to prevent accidental or intentional misuse.
Default Value
References
CIS Controls
- Version 7
Ensure that unauthorized software is either removed or updated in a timely manner.