Detections
Analytics

3.2.3 Ensure rds kernel module is not available

Information

The Reliable Datagram Sockets (RDS) protocol is a transport layer protocol designed to provide low-latency, high-bandwidth communications between cluster nodes. It was developed by the Oracle Corporation.

Removing support for unneeded protocols reduces the local attack surface of the system. If this protocol is not needed, disable it.

Solution

Unload and disable the rds kernel module.

 - Run the following commands to unload the rds kernel module:

# modprobe -r rds 2>/dev/null
# rmmod rds 2>/dev/null

 - Perform the following to disable the rds kernel module:

Create a file ending in .conf with install rds /bin/false in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "install rds /bin/false" >> /etc/modprobe.d/60-rds.conf

Create a file ending in .conf with blacklist rds in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "blacklist rds" >> /etc/modprobe.d/60-rds.conf

Impact:

The Reliable Datagram Sockets (RDS) protocol is used by some high-performance workloads (for example, Oracle RAC over InfiniBand). Disabling the rds kernel module has no operational impact unless such an application requires it.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: ef20a2aa4b04b3ca45e8acfe276ce829dcba7425252d7c2e3c006582897651d9