Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rule 2.2.19 - should be changed to mask rpcbind service and rpcbind.socket #236

Closed
areh opened this issue Nov 4, 2022 · 0 comments
Closed
Labels
bug Something isn't working

Comments

@areh
Copy link

areh commented Nov 4, 2022

Describe the Issue
Similar to #235
ipa-client depends on rpcbind. Removing it in an enterprise environment would be catastrophic.

Expected Behavior
Securing rpcbind should not break the system.
ipa-client should never be allowed to be removed.

Actual Behavior
rpcbind and rpcbind.socket should be masked as per the CIS benchmark

Control(s) Affected
ipa-client could be removed, which would break an enterprise platform.

Environment (please complete the following information):
Not relevant

Possible Solution
Change code to something like this:

- name: "2.2.19 | PATCH | Ensure rpcbind and rpcbind.socket are masked"
  systemd:
    name: "{{ item }}"
    masked: yes
    state: stopped
  with_items:
    - rpcbind
    - rpcbind.socket
@areh areh added the bug Something isn't working label Nov 4, 2022
@areh areh mentioned this issue Nov 18, 2022
georgenalen added a commit that referenced this issue Nov 21, 2022
Signed-off-by: George Nalen <georgen@mindpointgroup.com>
uk-bolly pushed a commit that referenced this issue Feb 1, 2023
Signed-off-by: George Nalen <georgen@mindpointgroup.com>
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants