Detections
Analytics

1.99 SOL-11.1-040320

Information

The nobody access for RPC encryption key storage service must be disabled.

GROUP ID: V-216350
RULE ID: SV-216350r959010

If login by the user "nobody" is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the "nobody" user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user.

Solution

Determine if the rpc-authdes package is installed:

# pkg list solaris/legacy/security/rpc-authdes

If the output of this command is:

pkg list: no packages matching 'solaris/legacy/security/rpc-authdes' installed

no further action is required.

The root role is required.

Modify the /etc/default/keyserv file.

# pfedit /etc/default/keyserv

Locate the line:

#ENABLE_NOBODY_KEYS=YES

Change it to:

ENABLE_NOBODY_KEYS=NO

See Also

https://workbench.cisecurity.org/benchmarks/23765

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216350r959010_rule, STIG-ID|SOL-11.1-040320, Vuln-ID|V-216350

Plugin: Unix

Control ID: 3c7a4abe2eea25a0de9f38e5574a20095a91117bfaf1aae7c76fe137d89f80d8