>From 264bee24b0e6efe8eab509258cbec205bf6ff6ff Mon Sep 17 00:00:00 2001 From: Shawn Wells Date: Fri, 16 Nov 2012 07:34:55 -0500 Subject: [PATCH 11/13] DISA FSO provided copy editing of RHEL6/input/services/nfs.xml --- RHEL6/input/services/nfs.xml | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml index fa0af28..c67abd0 100644 --- a/RHEL6/input/services/nfs.xml +++ b/RHEL6/input/services/nfs.xml @@ -69,7 +69,7 @@ this service should be disabled. Disable netfs if Possible To determine if any network filesystems handled by netfs are -currently mounted on the system execute the following command: +currently mounted on the system execute the following command.
# mount -t nfs,nfs4,smbfs,cifs,ncpfs
If the command did not return any output then disable netfs.
@@ -109,7 +109,7 @@ NFSv2, NIS (see Section 3.2.4 for information about NIS, which is not recommended), or any third-party or custom RPC-based program. If none of these programs are in use, however, rpcbind should be disabled to improve system security. In order to get more information about whether rpcbind may be -disabled on a given host, query rpcbind using the command: +disabled on a given host, query rpcbind using the following command.
# rpcinfo -p
If the only services listed are portmapper and status, it is safe to disable rpcbind. If other services are listed and your site is not running NFS or NIS, @@ -344,7 +344,7 @@ server. -To verify that the nodev option is configured for all NFS mounts, run the following command: +To verify the nodev option is configured for all NFS mounts, run the following command.
$ mount  | grep nfs
All NFS mounts should show the nodev setting in parentheses.
@@ -361,7 +361,7 @@ should not present device files to users. -To verify that the nosuid option is configured for all NFS mounts, run the following command: +To verify the nosuid option is configured for all NFS mounts, run the following command.
$ mount  | grep nfs
All NFS mounts should show the nosuid setting in parentheses.
@@ -484,7 +484,7 @@ Remove any instances of the insecure_locks option from the file /etc/exports. -To verify that insecure file locking has been disabled, run the following command: +To verify insecure file locking has been disabled, run the following command.
# grep insecure_locks /etc/exports
Allowing insecure file locking could allow for sensitive data to be -- 1.7.1