Avoid nfs altogether

src/freedombone-image-customise

     chroot "$rootdir" apt-get -yq dist-upgrade
     chroot "$rootdir" apt-get -yq install ca-certificates
     chroot "$rootdir" apt-get -yq install apt-utils
-    chroot "$rootdir" apt-get -yq install nfs-kernel-server
 
     if [[ $ARCHITECTURE == 'amd64' ]]; then
         chroot "$rootdir" apt-get -yq install linux-image-amd64
     chroot "$rootdir" apt-get -yq install tripwire
 
     # filesystem optimisations
-    sed -i 's|btrfs subvol=@|btrfs defaults,subvol=@,compress=lzo,ssd|g' $rootdir/etc/fstab
+    #sed -i 's|btrfs subvol=@|btrfs defaults,subvol=@,compress=lzo,ssd|g' $rootdir/etc/fstab
 }
 
 function image_install_nodejs {

src/freedombone-tests

     output "V-38641" $? ${SETLANG}
     ################
 
-    ##RHEL-06-000269
-    ##Remote file systems must be mounted with the nodev option.
-    if [ "$(mount | grep nfs | wc -l)" -gt 0 ];then
-        bash $STIG_TESTS_DIR/check-nfs.sh nodev >/dev/null 2>&1 &
-
-        stig_spinner $!
-        output "V-38652" $? ${SETLANG}
-    fi
-    ################
-
-    ##RHEL-06-000270
-    ##Remote file systems must be mounted with the nosuid option.
-    if [ "$(mount | grep nfs | wc -l)" -gt 0 ];then
-        bash $STIG_TESTS_DIR/check-nfs.sh nosuid >/dev/null 2>&1 &
-
-        stig_spinner $!
-        output "V-38654" $? ${SETLANG}
-    fi
-    ################
-
     ##RHEL-06-000271
     ##The noexec option must be added to removable media partitions.
     if [ "$(grep -Hv ^0$ /sys/block/*/removable | sed s/removable:.*$/device\\/uevent/ | xargs grep -H ^DRIVER=sd | sed s/device.uevent.*$/size/ | xargs grep -Hv ^0$ | cut -d / -f 4 | wc -l)" -gt 0 ];then
     output "V-38675" $? ${SETLANG}
     ################
 
-    ##RHEL-06-000309
-    ##The NFS server must not have the insecure file locking option enabled.
-
-    bash $STIG_TESTS_DIR/check-nfs-insecure.sh > /dev/null 2>&1 &
-
-    stig_spinner $!
-    output "V-38677" $? ${SETLANG}
-    ################
-
     ##RHEL-06-000319
     ##The system must limit users to 10 simultaneous system logins, or a site-defined number, in accordance with operational requirements.
 
     output "V-38462" $? ${SETLANG}
     ################
 
-    ##RHEL-06-000515
-    ##The NFS server must not have the all_squash option enabled.
-
-    bash $STIG_TESTS_DIR/check-nfs-all-squash.sh > /dev/null 2>&1 &
-
-    stig_spinner $!
-    output "V-38460" $? ${SETLANG}
-    ################
-
     ##RHEL-06-000523
     ##The systems local IPv6 firewall must implement a deny-all, allow-by-exception policy for inbound packets.
 

src/freedombone-utils-setup

     fi
 }
 
-function disable_nfs_insecure_locks {
-    apt-get -yq install nfs-kernel-server
-    if grep 'insecure_locks' /etc/exports; then
-        sed -i 's|,insecure_locks||g' /etc/exports
-        sed -i 's|insecure_locks,||g' /etc/exports
-        exportfs -a
-    fi
-}
-
 function remove_management_engine_interface {
     # see https://www.kernel.org/doc/Documentation/misc-devices/mei/mei.txt
     # Disabling this interface doesn't cure the problems of ME, but it
 }
 
 function lockdown_permissions {
-    if [ -d /etc/fs/nfs ]; then
-        remove_nfs
-    fi
     if [ -d /root/.npm ]; then
         find /root/.npm -name package.json -exec chmod 700 {} \;
     fi
     mark_completed $FUNCNAME
 }
 
-function remove_nfs {
-    apt-get -yq remove nfs-kernel-server
-    apt-get -yq remove nfs-common
-}
-
 function setup_firewall {
     function_check create_completion_file
     create_completion_file
     function_check proc_filesystem_settings
     proc_filesystem_settings
 
-    function_check remove_nfs
-    remove_nfs
-
     function_check optimise_filesystem
     optimise_filesystem
 
     function_check remove_bluetooth
     remove_bluetooth
 
-    function_check disable_nfs_insecure_locks
-    disable_nfs_insecure_locks
-
     function_check set_login_umask
     set_login_umask