# Ensure network file system services are not in use

Necessity: The Network File System (NFS) protocol allows for sharing directories and files with other systems over a network. If the system is not intended to be an NFS server, running these services introduces a significant security risk by unnecessarily increasing the system's attack surface. Misconfigured NFS services can lead to unauthorized file access, data leakage, and potential remote exploits. The `rpcbind` service, a prerequisite for NFS, has also been associated with security vulnerabilities.

Auditing and Remediation: The audit script verifies the status of the `nfs-kernel-server` and `rpcbind` packages and services to determine if they are installed and active. The remediation script takes action based on the desired state, either by stopping and disabling the services or by completely purging the associated packages from the system to eliminate the risk.

Recommended State Rationale:
- Basic: `['Not Installed', 'Disabled']`. A basic security posture requires that if the NFS packages are installed, the services must be disabled to prevent them from listening for network connections. The most secure option, 'Not Installed', is also included.
- Moderate: `['Not Installed']`. A moderate security level adheres to the principle of least functionality. If the system does not require NFS server capabilities, the software should not be installed, thus removing the potential for misconfiguration or future vulnerabilities.
- Strict: `['Not Installed']`. The strict and most secure configuration is the complete removal of all NFS server packages. This ensures the service cannot be accidentally or maliciously started and completely eliminates its attack surface from the system. For this control, the moderate and strict recommendations are identical as there is no more secure state than removal.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed', 'Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the `nfs-kernel-server` and `rpcbind` services are installed and enabled. The script should output a single string: 'Not Installed' if neither service package is installed, 'Disabled' if the packages are installed but the services are not enabled, or 'Enabled' if at least one of the services is installed and enabled. The output must contain only this string value, without any additional text or labels.

## Remediation Script Working

Bash script that accepts a single command-line argument to configure the network file system services (`nfs-kernel-server`, `rpcbind`). The argument can be either 'Not Installed' or 'Disabled'. If the argument is 'Not Installed', the script must completely remove the packages. If the argument is 'Disabled', the script must stop and disable the services. The script must output `true` on successful completion or `false` if an error occurs.

