[PATCH 3/5] Added rule regarding anonymous NFS connections
David Smith
dsmith at eclipse.ncsc.mil
Thu Jul 25 16:38:44 UTC 2013
Signed-off-by: David Smith <dsmith at eclipse.ncsc.mil>
---
RHEL6/input/services/nfs.xml | 11 +++++++++++
1 files changed, 11 insertions(+), 0 deletions(-)
diff --git a/RHEL6/input/services/nfs.xml b/RHEL6/input/services/nfs.xml
index c3514dd..9e40e4e 100644
--- a/RHEL6/input/services/nfs.xml
+++ b/RHEL6/input/services/nfs.xml
@@ -204,6 +204,17 @@ There is no need to run the NFS server daemons <tt>nfs</tt> and
designated as NFS servers. Ensure that these daemons are turned off on
clients.</description>
+<Rule id="nfs_no_anonymous">
+<title>Specify UID and GID for Anonymous NFS Connections</title>
+<description>To specify the UID and GID for remote root users, edit the <tt>/etc/exports</tt> file and add the following for each export:
+<pre>
+anonuid=-1
+anongid=-1
+</pre>
+</description>
+<rationale>Specifying the anonymous UID and GID as -1 ensures that the remote root user is mapped to a local account which has no permissions on the system.</rationale>
+</Rule>
+
<Rule id="service_nfs_disabled">
<title>Disable Network File System (nfs)</title>
<description>The Network File System (NFS) service allows remote hosts to mount
--
1.7.1
More information about the scap-security-guide
mailing list