Detections
Analytics

SOL-11.1-040320 - The nobody access for RPC encryption key storage service must be disabled.

Information

If login by the user "nobody" is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the "nobody" user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user.

Solution

Determine if the rpc-authdes package is installed:

# pkg list solaris/legacy/security/rpc-authdes

If the output of this command is:

pkg list: no packages matching 'solaris/legacy/security/rpc-authdes' installed

no further action is required.

The root role is required.

Modify the /etc/default/keyserv file.

# pfedit /etc/default/keyserv

Locate the line:

#ENABLE_NOBODY_KEYS=YES

Change it to:

ENABLE_NOBODY_KEYS=NO

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_11_x86_V3R6_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-216113r959010_rule, STIG-ID|SOL-11.1-040320, STIG-Legacy|SV-60961, STIG-Legacy|V-48089, Vuln-ID|V-216113

Plugin: Unix

Control ID: c2f0435154b2a7d43563ece5a3383e3bdcb1ba84da7984be64a6ab3cd48897c1