# Ensure rpcbind services are not in use

The `rpcbind` utility is a server that converts Remote Procedure Call (RPC) program numbers into universal addresses. When an RPC service is started, it tells `rpcbind` what address it is listening to and what RPC program numbers it is prepared to serve. This service is essential for legacy services like NFSv2/v3 and NIS, but it also presents a potential attack surface. Attackers can query `rpcbind` to enumerate RPC services running on the host, which can reveal information about the system and potential vulnerabilities. The risk of misconfiguration is that unnecessary services could be exposed to the network, increasing the system's vulnerability. The audit script verifies the status of the `rpcbind` package and its corresponding systemd units to determine if it is installed and active. The remediation script either disables the service or completely removes the package to mitigate the risk. The recommended states are justified as follows: Basic ('Disabled') is the minimum acceptable state, preventing the service from running but leaving the software on the system. Moderate and Strict ('Not Installed') represent the most secure configuration by completely removing the package, adhering to the principle of least functionality and eliminating any chance of the service being inadvertently started.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the `rpcbind` service is installed and enabled. The script should first check if the `rpcbind` package is installed. If it is not installed, the script should output the string 'Not Installed'. If the package is installed, the script should check the status of both `rpcbind.service` and `rpcbind.socket` using `systemctl is-enabled`. If either unit is enabled, the script should output 'Enabled'. Otherwise, it should output 'Disabled'. The script must only return one of these three strings: 'Not Installed', 'Disabled', or 'Enabled', with no other text.

## Remediation Script Working

Bash script that accepts a single positional argument to set the state of the `rpcbind` service. If the argument is 'Disabled', the script must stop and disable both `rpcbind.service` and `rpcbind.socket` using `systemctl`. If the argument is 'Not Installed', the script must completely remove the `rpcbind` package using `apt-get remove --purge -y`. The script must return `true` on success and `false` on failure.

