# Ensure rpcbind services are not in use

The rpcbind service maps Remote Procedure Call (RPC) program numbers to network port numbers. It is a prerequisite for services like NFS and NIS. This service presents a security risk as it can be queried by attackers to gather information about running RPC services on the host, a technique known as RPC scanning. It has also been associated with various vulnerabilities. Disabling or removing rpcbind is crucial for reducing the system's attack surface, especially if services dependent on it are not in use.

The audit script checks the current state of the rpcbind service using 'systemctl', determining if it is enabled, disabled, or not installed. The remediation script uses 'systemctl' to stop and disable the service, preventing it from running.

The recommended states are structured to provide layered security:
- **Basic:** ['disabled'] - This is the minimum requirement. Disabling the service prevents it from starting automatically, mitigating the immediate risk of exposure.
- **Moderate:** ['disabled', 'not installed'] - This is a stronger recommendation, accepting either a disabled service or its complete absence from the system.
- **Strict:** ['not installed'] - This is the most secure configuration. By completely removing the rpcbind package, the possibility of accidental or malicious activation is eliminated, and any potential vulnerabilities within the package's files are removed from the system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled', 'not installed']` |
| **Strict** | `['not installed']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks the status of the 'rpcbind' service. The script must query systemd to determine if the service is enabled. If the service unit does not exist, the script must output 'not installed'. Otherwise, it must output the exact status returned by 'systemctl is-enabled rpcbind' (e.g., 'enabled', 'disabled'). The script must not return any other text or formatting.

## Remediation Script Working

shell script that accepts the desired state (e.g., 'disabled') as a single command-line argument. The script must use 'systemctl --now disable rpcbind' to both stop the live service and disable it from starting at boot. The script must return the string 'true' upon successful execution and 'false' upon failure.

