# Ensure rds kernel module is not available

Necessity: The Reliable Datagram Sockets (RDS) protocol is a high-performance, low-latency protocol designed for specific environments like InfiniBand networks. For the vast majority of systems, this protocol is not used. Leaving unused kernel modules available increases the system's attack surface. A vulnerability in the 'rds' module could potentially be exploited to gain elevated privileges, even if the protocol is not in active use. Disabling unnecessary modules adheres to the security principle of least functionality, minimizing potential vectors for compromise.

Auditing and Remediation: The audit script confirms the module's disabled status by checking two conditions: that it is not currently loaded into the kernel memory and that a configuration exists to prevent it from being loaded automatically. The remediation script actively enforces this state by first unloading the module if it's running and then creating a `modprobe` configuration file to permanently prevent it from loading on subsequent system boots.

Recommended State Rationale: The recommendation of 'Not Available' is consistent across Basic, Moderate, and Strict security levels. For this type of configuration, there is no intermediate state that provides a security benefit. If the functionality provided by the 'rds' module is not explicitly required by a system's primary function, it should be disabled entirely. This binary choice (enabled or disabled) means that any level of hardening necessitates its removal to reduce the kernel's attack surface. Therefore, the most secure and recommended state for all levels is to ensure the module is not available.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Available']` |
| **Moderate** | `['Not Available']` |
| **Strict** | `['Not Available']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'rds' kernel module is disabled. The script should verify that the module is not currently loaded (using `lsmod`) and that its installation is prevented (typically by a configuration in `/etc/modprobe.d/`). The script must return only the string 'Not Available' if the module is successfully disabled, or 'Available' if it is not.

## Remediation Script Working

Bash script that accepts a single argument to set the state of the 'rds' kernel module. If the argument is 'Not Available', the script must unload the module if it is currently loaded (using `rmmod`) and create a configuration file in `/etc/modprobe.d/` with the line `install rds /bin/true` to prevent it from being loaded on boot. The script must return 'true' upon successful configuration or 'false' if it fails.

