documentation_complete: true

title: 'Disable Network File System (nfs)'

description: |-
    The Network File System (NFS) service allows remote hosts to mount
    and interact with shared filesystems on the local system. If the local system
    is not designated as a NFS server then this service should be disabled.
    <chkconfig-service-macro enable="false" service="nfs" />

rationale: 'Unnecessary services should be disabled to decrease the attack surface of the system.'

severity: unknown

identifiers:
    cce: 27199-9

ocil_clause: 'it does not'

ocil: "It is prudent to ensure the <tt>nfs</tt> service is disabled in system boot, as well as \nnot currently running.  First, run the following to verify the service is stopped:\n<pre>$ service nfs status</pre>\nIf the service is stopped or disabled, it will return the following:\n<pre>rpc.svcgssd is stopped\nrpc.mountd is stopped\nnfsd is stopped\nrpc.rquotad is stopped</pre>\nTo verify that the <tt>nfs</tt> service is disabled, run the following command:\n<pre>$ chkconfig --list nfs</pre>\nIf properly configured, the output should look like:\n<pre>nfs            \t0:off\t1:off\t2:off\t3:off\t4:off\t5:off\t6:off</pre>"
