Disable "nobody" Access for RPC Encryption Key Storage Service

HighLevel 1Automatedsolaris

Description

This action listed prevents keyserv from using default keys for the nobody user, effectively stopping the nobody user from accessing information via Secure RPC. If login by the user nobody is allowed for secure RPC, there is an increased risk of system compromise. Audit: compliant when keyserv is not installed.

How it is checked

Audit method: Shell command

shell

f=/etc/default/keyserv; [ -f "$f" ] || { echo compliant; exit 0; }; grep -q "^ENABLE_NOBODY_KEYS=NO" "$f" && echo compliant || echo "ENABLE_NOBODY_KEYS is not NO"

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Perform the following to implement the recommended state: # cd /etc/default # cp keyserv keyserv.orig # awk '/ENABLE_NOBODY_KEYS=/ { $1 = "ENABLE_NOBODY_KEYS=NO" } { print }' keyserv > keyserv.CIS # mv keyserv.CIS keyserv

Properties

Operating systems: Any
Tags: solarisnetwork
Reference: CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.14 Disable "nobody" Access for RPC Encryption Key Storage Service

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target solaris