How to Completely Disable ‘Rpcbind’ (RPC Portmapper) in Ubuntu Server

The rpcbind utility is a server daemon in Ubuntu Linux that maps Remote Procedure Call (RPC) program numbers to universal addresses (listening ports). When an RPC service—most commonly NFS (Network File System) or NIS (Network Information Service)—starts up, it tells rpcbind which port it is listening on. Client machines then query rpcbind on port 111 to find the correct port to connect to the requested service. However, if your Ubuntu Server is operating solely as a web server (Nginx/Apache), a database server (MySQL/PostgreSQL), or a Docker host, you likely are not utilizing NFS. Leaving the rpcbind daemon running and actively listening on port 111 unnecessarily expands your server’s attack surface.

This guide explains how to completely disable and mask the rpcbind daemon in Ubuntu Server, ensuring port 111 is permanently closed to external traffic.

Stop and Mask Rpcbind via Systemctl

Because rpcbind is deeply entrenched in the Linux networking stack, simply attempting to remove it via apt-get purge rpcbind can trigger the removal of vital, tangentially related network utilities. The safest and most robust method for neutralizing the service is to mask it via systemd.

1. Log into your Ubuntu Server as a root-privileged user via SSH or the local console.
2. First, verify that the daemon is running and actively listening:

   sudo systemctl status rpcbind.service

3. You must stop both the service and its associated socket (which systemd uses to wake the service on demand):

   sudo systemctl stop rpcbind.service rpcbind.socket

4. Disable the service to prevent it from initializing during the server boot sequence:

   sudo systemctl disable rpcbind.service rpcbind.socket

5. Finally, mask the service. Masking creates a symlink pointing to /dev/null, making it completely impossible for any script, dependency, or manual command to start the daemon:

   sudo systemctl mask rpcbind.service rpcbind.socket

Verify Port Closure

To confirm that your server is no longer vulnerable on the RPC port, use the ss (socket statistics) command to check your listening ports.

1. Execute the following command to list all listening TCP and UDP ports:

   sudo ss -tulpn | grep 111

2. If the masking was successful, the command should return absolutely no output, confirming that port 111 is fully closed and the rpcbind daemon is dead.