# Ensure network file system services are not in use

Necessity: Network File System (NFS) allows remote systems to access files over a network as if they were local. Running an unnecessary NFS server significantly increases the system's attack surface. A misconfigured NFS server can expose sensitive data, allow unauthorized file modification, and potentially lead to remote code execution or a full system compromise. The principle of least functionality dictates that any service not explicitly required should be disabled or removed to minimize security risks. Auditing and Remediation: The audit script verifies whether the NFS software is installed and if the corresponding services are enabled to run at boot. The remediation script takes action based on the desired state. It either disables the services to prevent them from running or completely uninstalls the 'nfs-utils' package, thereby removing the capability from the system entirely. Recommended State Rationale: Basic: ['Disabled'] represents the minimum acceptable security posture. It ensures the service is not actively running or listening for connections, mitigating immediate threats. This is suitable if the service might be needed in the future. Moderate: ['Not Installed'] is a more secure state that removes the software package itself. This prevents the service from being accidentally or maliciously started and adheres to security best practices for hardening systems by removing all non-essential software. Strict: ['Not Installed'] is the most secure configuration. For a server that has no requirement to share files via NFS, completely removing the software is the definitive method to eliminate its associated attack surface, leaving no room for misconfiguration or future vulnerabilities in that package.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'nfs-utils' package is installed. If it is installed, the script should then check if the 'nfs-server' service is enabled. The script must output only one of the following strings: 'Not Installed', 'Disabled', or 'Enabled'.

## Remediation Script Working

Bash script that accepts one positional argument: 'Disabled' or 'Not Installed'. If the argument is 'Disabled', the script must use 'systemctl --now disable' on the 'nfs-server' and 'rpcbind' services. If the argument is 'Not Installed', the script must use the system's package manager ('yum' or 'dnf') to remove the 'nfs-utils' package. The script must return 'true' on success and 'false' on failure.

