TMA-AIX-4.4.1.2
Ensure NFS server services are not in use
Description
De-install NFS server if the server does not act as an NFS server to remote clients. An expected exception is a system configured as a NIM server. NFS is frequently exploited to gain unauthorized access to file and directories. Unless the server needs to act as an NFS server or client, the filesets should be de-installed. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
command -v lslpp >/dev/null 2>&1 || exit 1; lslpp -L >/dev/null 2>&1 || exit 1; out=$( { lslpp -L | grep -i 'bos.net.nfs.server' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Ensure that there are no current NFS exports: cat /etc/exports The above command should yield no output. Or the file should not exist. De-install the NFS sever software: installp -u bos.net.nfs.server If there was an empty /etc/exports file, remove it: rm /etc/exports
Properties
- Operating systems
- Any
- Tags
- aixnetwork
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.1.2 Ensure NFS server services are not in use
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix