Ensure nfs_use_reserved_ports is enabled

MediumLevel 1Automatedaix

Description

The portcheck and nfs_use_reserved_ports parameters force the NFS server process on the local system to ignore NFS client requests that do not originate from the privileged ports range (ports less than 1024). The portcheck and nfs_use_reserved_ports parameters will both be set to 1. This value means that NFS client requests that do not originate from the privileged ports range (ports less than 1024) will be ignored by the local system. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

How it is checked

Audit method: Shell command

shell

command -v nfso >/dev/null 2>&1 || exit 1; out=$(nfso -a 2>/dev/null) || exit 1; r=compliant; for p in '^[[:blank:]]*portcheck[[:blank:]]*=[[:blank:]]*1$' '^[[:blank:]]*nfs_use_reserved_ports[[:blank:]]*=[[:blank:]]*1$'; do printf '%s\n' "$out" | grep -Eq -- "$p" || r="missing: $p"; done; echo "$r"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

nfso -p -o portcheck=1; nfso -p -o nfs_use_reserved_ports=1

Properties

Operating systems: Any
Tags: aixhardening
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 4.5.14 Ensure nfs_use_reserved_ports is enabled

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix