Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
RHEL6/input/services/nfs.xml | 109 ++++-------------------------------------
1 files changed, 11 insertions(+), 98 deletions(-)
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index 4308d78..e1428af 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -15,7 +15,6 @@ clients, as well as to those operating as NFS servers.
NFS client or an NFS server, follow all instructions in this section to disable
subsystems required by NFS.
</description>
-
<warning category="general">The steps in this section will prevent a
machine
from operating as either an NFS client or an NFS server. Only perform these
steps on machines which do not need NFS at all.</warning>
@@ -86,50 +85,7 @@ and against flaws in the netfs script itself.
<oval id="service_netfs_disabled" />
</Rule>
</Group>
-<Group id="disabling_rpcbind">
-<title>Disable RPC Bind Service if Possible</title>
-<description>If:
-<ul>
-<li>NFSv3 or NFSv2 is not needed (NFSv4 implementations do not require the use
-of the RPC Bind Service)</li>
-<li>The site does not rely on NIS for authentication information,
-and</li>
-<li>The machine does not run any other RPC-based service</li>
-</ul>
-then disable the RPC bind service.
-<br /><br />
-By design, the RPC model does not require particular services to listen on
-fixed ports, but instead uses a daemon, rpcbind, to tell prospective clients
-which ports to use to contact the services they are trying to reach. This model
-weakens system security by introducing another privileged daemon which may be
-directly attacked, and is unnecessary because RPC was never adopted by enough
-services to risk using up all the ports on a system. Unfortunately, rpcbind is
-central to RPC design, so it cannot be disabled if your site is using NFSv3 or
-NFSv2, NIS (see Section 3.2.4 for information about NIS, which is not
-recommended), or any third-party or custom RPC-based program. If none of these
-programs are in use, however, rpcbind should be disabled to improve system
-security. In order to get more information about whether rpcbind may be
-disabled on a given host, query rpcbind using the following command:
-<pre># rpcinfo -p</pre>
-If the only services listed are portmapper and status, it is safe to disable
-rpcbind. If other services are listed and your site is not running NFS or NIS,
-investigate these services and disable them if possible.
-</description>
-<Rule id="service_rpcbind_disabled">
-<title>Disable RPC Bind Service (rpcbind)</title>
-<description>The rpcbind service is responsible for mapping RPC services to the
-TCP ports that they listen on. The rpcbind service also directs RPC clients to
-the proper port number that corresponds to the service the clients wants to
-communicate with. Unless RPC services are needed on the local system it is
-recommended to disable this service.
-<service-disable-macro service="rpcbind" />
-</description>
-<ident cce="27268-2" />
-<oval id="service_rpcbind_disabled" />
-</Rule>
-
-</Group>
</Group>
<Group id="nfs_configuring_all_machines">
@@ -150,32 +106,6 @@ from the other) should never be used.
</Group> <!-- <Group id="nfs_client_or_server_not_both"> -->
-<Group id="nfs_restrict_access_rpcbind">
-<title>Restrict Access to rpcbind</title>
-<description>When using NFSv2 or NFSv3 which require <tt>rpcbind</tt>,
access
-to the <tt>rpcbind</tt> service should be restricted by using TCP Wrappers.
The
-<tt>/etc/hosts.allow</tt> and <tt>/etc/hosts.deny</tt> files are
used by TCP
-Wrappers to determine whether specified remote hosts are allowed to access
-certain services. The default RPC Bind service shipped with RHEL6 has TCP
-Wrappers support built in, so this specification can be used to provide some
-protection against network attacks on <tt>rpcbind</tt>.
-<br /><br />
-Note: This step protects only the RPC Bind service itself. It is still possible
-for attackers to guess the port numbers of NFS services and attack those
-services directly, even if they are denied access to <tt>rpcbind</tt>.
-<br /><br />
-Edit the file <tt>/etc/hosts.deny</tt>. Add or correct the line:
-<pre>rpcbind: ALL</pre>
-Edit the file <tt>/etc/hosts.allow</tt>. Add or correct the line:
-<pre>rpcbind: IPADDR1 , IPADDR2 , ...</pre>
-where each <tt>IPADDR</tt> is the IP address of a server or client with
which
-this machine shares NFS filesystems. If the machine is an NFS server, it may be
-simpler to use an IP netblock specification, such as 10.3.2. (this is the TCP
-Wrappers syntax representing the netblock 10.3.2.0/24), or a hostname
-specification, such as .subdomain.example.com. The use of hostnames is not
-recommended. </description>
-
-</Group> <!-- <Group id="nfs_restrict_access_rpcbind"> -->
<Group id="nfs_configure_fixed_ports">
<title>Configure NFS Services to Use Fixed Ports (NFSv3 and NFSv2)</title>
@@ -226,8 +156,8 @@ Where <tt>lockd-port</tt> is a port which is not used by
any other service on
your network.
</description>
-<rationale>
-Restrict service to always use a given port, so that firewalling can be done
effectively.
+<rationale> Restricting services to always use a given port enables firewalling
+to be done more effectively.
</rationale>
<ident cce="27063-7" />
<oval id="nfs_fixed_lockd_udp_port" />
@@ -241,8 +171,8 @@ file <tt>/etc/sysconfig/nfs</tt>. Add or correct the
following line:
<pre>STATD_PORT=statd-port</pre>
Where <tt>statd-port</tt> is a port which is not used by any other service on
your network.
</description>
-<rationale>
-Restrict service to always use a given port, so that firewalling can be done
effectively.
+<rationale> Restricting services to always use a given port enables firewalling
+to be done more effectively.
</rationale>
<ident cce="26889-6" />
<oval id="nfs_fixed_statd_port" />
@@ -256,8 +186,8 @@ file <tt>/etc/sysconfig/nfs</tt>. Add or correct the
following line:
<pre>MOUNTD_PORT=statd-port</pre>
Where <tt>mountd-port</tt> is a port which is not used by any other service
on your network.
</description>
-<rationale>
-Restrict service to always use a given port, so that firewalling can be done
effectively.
+<rationale> Restricting services to always use a given port enables firewalling
+to be done more effectively.
</rationale>
<ident cce="27114-8" />
<oval id="nfs_fixed_mountd_port" />
@@ -318,7 +248,6 @@ RPC then this service should be disabled.
</ocil>
<rationale>Unnecessary services should be disabled to decrease the attack surface
of the system.</rationale>
<ident cce="27122-1" />
-<ident cce="27128-8" />
<oval id="service_rpcsvcgssd_disabled" />
<tested by="DS" on="20121025"/>
</Rule>
@@ -426,21 +355,6 @@ so do not specify <tt>rw</tt> without a good reason.
</description>
</Group> <!-- export_filesystems_read_only -->
-<Group id="specify_anonymous_uid_gid">
-<title>Specify UID and GID for Anonymous Connections</title>
-<description>When an NFS server is configured to deny remote
<tt>root</tt>
-access, a selected UID and GID are used to handle requests from the remote
-<tt>root</tt> user. The UID and GID should be chosen from the system to
provide
-the appropriate level of non-privileged access. By default, the NFS server will
-map remote <tt>root</tt> users to the <tt>nobody</tt> local
account. Specifying
-the anonymous UID and GID as -1 ensures that the remote <tt>root</tt> user
is
-mapped to a local account which has no permissions on the system.
-<br /><br />
-To specify the UID and GID for remote <tt>root</tt> users, edit the
-<tt>/etc/exports</tt> file and add <tt>anonuid=-1</tt> and
<tt>anongid=-1</tt>
-to the options list for each export.
-</description>
-</Group> <!-- specify_anonymous_uid_gid -->
<Rule id="use_root_squashing_all_exports">
<title>Use Root-Squashing on All Exports</title>
@@ -452,25 +366,25 @@ should not be disabled.
Ensure that no line in <tt>/etc/exports</tt> contains the option
<tt>no_root_squash</tt>.
</description>
<rationale>If the NFS server allows root access to local file systems from remote
hosts, this
-access could be used to compromise the system.</rationale>
+access could be used to compromise the system.
+</rationale>
<ident cce="27138-7" />
-<oval id="TO:DO" />
</Rule>
<Rule id="restrict_nfs_clients_to_privileged_ports">
<title>Restrict NFS Clients to Privileged Ports</title>
-<description>By default, Linux's NFS implementation requires that all client
requests be made
+<description>By default, the server NFS implementation requires that all client
requests be made
from ports less than 1024. If your organization has control over machines connected to
its
network, and if NFS requests are prohibited at the border firewall, this offers some
protection
against malicious requests from unprivileged users. Therefore, the default should not be
changed.
<br /><br />
-Ensure that no line in <tt>/etc/exports</tt> contains the option
<tt>insecure</tt>.
+To ensure that the default has not been changed, ensure no line in
+<tt>/etc/exports</tt> contains the option <tt>insecure</tt>.
</description>
<rationale>Allowing client requests to be made from ports higher than 1024 could
allow a unprivileged
user to initiate an NFS connection. If the unprivileged user account has been
compromised, an
attacker could gain access to data on the NFS server.</rationale>
<ident cce="27121-3" />
-<oval id="TO:DO" />
</Rule>
<Rule id="no_insecure_locks_exports" severity="medium">
@@ -494,7 +408,6 @@ To verify insecure file locking has been disabled, run the following
command:
viewed or edited by an unauthorized user.
</rationale>
<ident cce="27167-6" />
-<oval id="TO:DO" />
<ref disa="764" />
</Rule>
--
1.7.1