rpc.statd running on system not using NFS

Question

I have a Debian machine that gets warnings (via the Tiger automatic auditor) that rcp.statd is listening on such-and-such socket. Googling shows rpc.statd is a daemon used by NFS. As far as I know, I'm not using (and have not installed) anything related to NFS.

What would have installed/started this service, and what do I need to do to disable the appropriate rcp.statd and NFS daemons?

Solution 1

What would have installed/started this service

The debian installer.
I was also surprised to find it enabled because

1. I did not ask for it
2. I was not told it would have been running
3. It is a security risk
4. Not many people use NFS nowdays

and what do I need to do to disable the appropriate rcp.statd and NFS daemons?

This:

update-rc.d nfs-common disable
update-rc.d rpcbind disable

Reboot or issue the following commands to stop the daemons the debian way

service nfs-common stop
service rpcbind stop

Finally to verify which TCP ports are open issue the following

netstat -lntp

Solution 2

by default NFS is enabled you can remove packages:

apt-get --purge remove nfs-kernel-server nfs-common portmap

or stop services temporary:

/etc/init.d/portmap stop
/etc/init.d/nfs-kernel-server stop

or stop them permanently:

service portmap stop
service nfs-kernel-server stop

Solution 3

For Ubuntu, I have done this:

sudo netstat -tulpn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
...     
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      681/rpcbind

Uninstall it:

sudo apt-get remove --auto-remove rpcbind
sudo apt-get purge --auto-remove rpcbind

Then double check if still running:

sudo netstat -tulpn

Comments

[keyboardsamurai]

Thanks, I didn't realize it was enabled by default. Does the service command exist on Debian? I thought it was only for RedHat-based systems (and then for stopping services temporarily, not permanently).

[artfulrobot]

I don't seem to have /etc/init.d/nfs-kernel-server on my server, how can I stop rpc.statd?

[Tao Hu]

With systemd in debian 8 systemctl disable nfs-common, systemctl disable rpcbind, systemctl stop nfs-common, systemctl stop rpcbind. Though systemv version still works.

[Pavel]

Run apt-get remove --purege rpcbind.