IBM AIX
TMA-AIX-4.3.1.5
Ensure rcnfs service is not in use
Description
The rcnfs entry starts the NFS, NIS and automount daemons during system boot. Additionally, it automounts filesystems with the attribute vfs = nfs. NFS is a service with numerous historical vulnerabilities and should not be enabled unless there is no alternative. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
command -v lsitab >/dev/null 2>&1 || exit 1; out=$( { lsitab rcnfs | grep -v off ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Use the chitab command to disable the NFS start-up script in /etc/inittab: Note: Do not use the rmitab to remove the NFS start-up script from /etc/inittab as it may return during a update. chitab "rcnfs:23456789:off:/etc/rc.nfs > /dev/console 2>&1 # Start NFS Daemons" Also, to be certain NFS and NIS related services have been stopped - execute the following script: /etc/nfs.clean
Properties
- Operating systems
- Any
- Tags
- aixservices
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.1.5 Ensure rcnfs service is not in use
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix