Detections
Analytics

2.2.24 Ensure NFS is configured to use RPCSEC_GSS - NFS is configured to use RPCSEC_GSS.

Information

The operating system must be configured so that the Network File System (NFS) is configured to use RPCSEC_GSS.

Rationale:

When an NFS server is configured to use RPCSEC_SYS, a selected userid and groupid are used to handle requests from the remote user. The userid and groupid could mistakenly or maliciously be set incorrectly. The RPCSEC_GSS method of authentication uses certificates on the server and client systems to more securely authenticate the remote mount request.

Solution

Update the /etc/fstab file so the option sec is defined for each NFS mounted file system and the sec option does not have the sys setting.
Example: vim /etc/fstab
Ensure the sec option is defined as krb5:krb5i:krb5p.

192.168.21.5:/mnt/export /data1 nfs4 rw,sync ,soft,sec=krb5:krb5i:krb5p

See Also

https://workbench.cisecurity.org/files/3636

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CCI|CCI-000366, CSCv6|3.1, CSCv7|9.2, Rule-ID|SV-204626r603261_rule, STIG-ID|RHEL-07-040750

Plugin: Unix

Control ID: 70a365d0966295f6a8c01fa643f3d8de9f8e31f96c95b9117f6cc99ec2ba0f85