Detections
Analytics

4.4.1.1 Ensure NFS client mounts are disabled in /etc/filesystems

Information

Disable automated mount of remote NFS shares.

NFS is frequently exploited to gain unauthorized access to files and directories. Automated and/or pre-defined mounts should not exist.

AIX does not allow the kernel service that enables NFS mounts to be disabled.

The protection against unauthorized mounts is that only accounts in the group system can mount pre-existing (i.e., defined in /etc/filesystems ) NFS mounts. Non-existing NFS mounts require root (euid==0) access.

Solution

Ensure that there are no current NFS client mounts:

mount |grep "nfs"
cat /etc/filesystems |grep "nfs"

The above commands should yield no output.

Stop NFS services:

stopsrc -g nfs

Impact:

The use of NFS mounts is discouraged. The only expected use of NFS is when used in combination with a NIM server for system maintenance.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: a238a127a39679519533249ab123946cc3c3f612692e266674b8e3f59837ff5f