[PATCH 3/5] Added rule regarding anonymous NFS connections

David Smith dsmith at eclipse.ncsc.mil
Thu Jul 25 16:38:44 UTC 2013


Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
 RHEL6/input/services/nfs.xml |   11 +++++++++++
 1 files changed, 11 insertions(+), 0 deletions(-)

diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index c3514dd..9e40e4e 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -204,6 +204,17 @@ There is no need to run the NFS server daemons <tt>nfs</tt> and
 designated as NFS servers. Ensure that these daemons are turned off on
 clients.</description>
 
+<Rule id="nfs_no_anonymous">
+<title>Specify UID and GID for Anonymous NFS Connections</title>
+<description>To specify the UID and GID for remote root users, edit the <tt>/etc/exports</tt> file and add the following for each export:
+<pre>
+anonuid=-1
+anongid=-1
+</pre>
+</description>
+<rationale>Specifying the anonymous UID and GID as -1 ensures that the remote root user is mapped to a local account which has no permissions on the system.</rationale>
+</Rule>
+
 <Rule id="service_nfs_disabled">
 <title>Disable Network File System (nfs)</title>
 <description>The Network File System (NFS) service allows remote hosts to mount
-- 
1.7.1



More information about the scap-security-guide mailing list