I have a Debian machine that gets warnings (via the Tiger automatic auditor) that rcp.statd is listening on such-and-such socket. Googling shows rpc.statd is a daemon used by NFS. As far as I know, I'm not using (and have not installed) anything related to NFS.

What would have installed/started this service, and what do I need to do to disable the appropriate rcp.statd and NFS daemons?


What would have installed/started this service

The debian installer.
I was also surprised to find it enabled because

  1. I did not ask for it
  2. I was not told it would have been running
  3. It is a security risk
  4. Not many people use NFS nowdays

and what do I need to do to disable the appropriate rcp.statd and NFS daemons?


update-rc.d nfs-common disable
update-rc.d rpcbind disable

Reboot or issue the following commands to stop the daemons the debian way

service nfs-common stop
service rpcbind stop

Finally to verify which TCP ports are open issue the following

netstat -lntp
  • 6
    With systemd in debian 8 systemctl disable nfs-common, systemctl disable rpcbind, systemctl stop nfs-common, systemctl stop rpcbind. Though systemv version still works. – user3132194 Feb 25 '16 at 7:58

by default NFS is enabled you can remove packages:

apt-get --purge remove nfs-kernel-server nfs-common portmap

or stop services temporary:

/etc/init.d/portmap stop
/etc/init.d/nfs-kernel-server stop

or stop them permanently:

service portmap stop
service nfs-kernel-server stop
  • Thanks, I didn't realize it was enabled by default. Does the service command exist on Debian? I thought it was only for RedHat-based systems (and then for stopping services temporarily, not permanently). – jrdioko Sep 9 '11 at 20:17
  • I don't seem to have /etc/init.d/nfs-kernel-server on my server, how can I stop rpc.statd? – artfulrobot May 17 '13 at 9:48
  • 1
    Run apt-get remove --purege rpcbind. – Pavel Mar 21 '16 at 9:28

For Ubuntu, I have done this:

sudo netstat -tulpn

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0   *               LISTEN      681/rpcbind

Uninstall it:

sudo apt-get remove --auto-remove rpcbind
sudo apt-get purge --auto-remove rpcbind

Then double check if still running:

sudo netstat -tulpn

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.