TMA-AZURE-STORAGE-7.2.4
Ensure root squash for NFS file shares is configured (Classic File Shares)
Description
Note: This recommendation applies to Classic File Shares (Azure file shares hosted in a storage account, the Microsoft.Storage provider). Permissions for NFS file shares are enforced by the client OS rather than by the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients. Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines are not fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker cannot exploit root privileges to access or modify critical files on the N...
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Audit from Azure Portal 1. Go to Storage accounts. 2. For each storage account with NFS file shares, under Data storage, click File shares. 3. Click the name of an NFS file share. 4. Click Properties. 5. Under ROOT SQUASH, ensure that Root Squash is selected. 6. Repeat steps 1-5 for each NFS file share in each storage account. Audit from Azure CLI Run the following command to list storage accounts: az storage account list --query "[].{name:name, resourceGroup:resourceGroup}" --output table For each storage account, run the following command to list its file shares with their protocol and root squash settings (the management-plane share-rm command returns rootSquash; the data-plane share list command does not): az storage share-rm list --resource-group <resource-group> --storage-account <storage-account> --query "[].{name:name, enabledProtocols:enabledProtocols, rootSquash:rootSquash}" --output table For each NFS file share (enabledProtocols is NFS), ensure that rootSquash is set to RootSquash. To view a single share's setting, run: az storage share-rm show --resource-group <resource-group> --storage-account <storage-account> --name <file-share-name> --query rootSquash Audit from...
How it is fixed
Fix method: Guidance or infrastructure patch
Remediate from Azure Portal 1. Go to Storage accounts. 2. For each storage account with NFS file shares, under Data storage, click File shares. 3. Click the name of an NFS file share. 4. Click Properties. 5. Under ROOT SQUASH, select Root Squash from the drop-down menu. 6. Click Save. 7. Repeat steps 1-6 for each NFS file share requiring remediation in each storage account. Remediate from Azure CLI For each NFS file share requiring remediation, run the following command to enable root squash: az storage share-rm update --resource-group <resource-group> --storage- account <storage-account> --name <nfs-file-share> --root-squash RootSquash Remediate from PowerShell For each NFS file share requiring remediation, run the following command to enable root squash: Update-AzRmStorageShare -ResourceGroupName <resource-group> - StorageAccountName <storage-account> -Name <nfs-file-share> -RootSquash RootSquash
Properties
- Operating systems
- Any
- Tags
- azurecloudstorage
- Reference
- CIS Microsoft Azure Storage Services Benchmark v2.0.0 - 7.2.4 Ensure root squash for NFS file shares is configured (Classic File Shares)