Ensure network file system services are not in use

MittelStufe 1Automatisiertlinux

Beschreibung

The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q nfs-utils' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package nfs-utils is not installed' || { echo step1: missing 'package nfs-utils is not installed'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled nfs-server.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step3: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step3: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active nfs-server.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step3: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Run the following command to stop nfs-server.service and remove nfs-utils package: # systemctl stop nfs-server.service # dnf remove nfs-utils - OR - - IF - the nfs-utils package is required as a dependency: Run the following commands to stop and mask the nfs-server.service: # systemctl stop nfs-server.service # systemctl mask nfs-server.service

Eigenschaften

Betriebssysteme: rocky-9
Tags: cis-convertedlinux
Referenz: CIS Rocky Linux 9 Benchmark v3.0.0 - 2.1.10

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target linux