Servers – Ensure NFS and RPC Services are Disabled

Support > Fixing Checks > Server

06 March, 2026

This check ensures that NFS and RPC services are disabled unless explicitly required.

Leaving these services enabled unnecessarily increases the attack surface and exposes the system to potential remote exploitation.

Check Details

Resource: Server
Check: Ensure NFS and RPC services are not enabled
Risk: Enabled NFS/RPC services can expose the system to unauthorized access and increase the remote attack surface.

Open a terminal session with root or sudo privileges.
Verify that NFS service is disabled:
```
systemctl is-enabled nfs-server
```
Verify that RPC service is disabled:
```
systemctl is-enabled rpcbind
```
Ensure the output for both commands is "disabled". If either service is enabled, proceed with the steps below.
Disable NFS service immediately and prevent it from starting on boot:
```
sudo systemctl --now disable nfs-server
```
Disable RPC service immediately and prevent it from starting on boot:
```
sudo systemctl --now disable rpcbind
```
Re-run the audit commands to confirm both services are disabled.
On systems where /etc is stateless (e.g., Container-Optimized OS), these steps must be repeated after every reboot.
Perform regular audits to ensure these services remain disabled unless explicitly required.