Ensure NFS client mounts include nosuid and nodev options

Cómo se verifica

Método de auditoría: Comando de shell

command -v lsnfsmnt >/dev/null 2>&1 || exit 1; out=$( { lsnfsmnt -l | egrep -v "^Name" | grep -v nosuid; lsnfsmnt -l | egrep -v "^Name" | grep -v nodev ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

For each NFS mount, disable suid programs and device access. List the current NFS mounts: lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nosuid" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nodev" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done NOTE: The NFS mount needs is re-mounted automatically by chnfsmnt. NOTE: The second loop might not do anything as both loops set both nosuid (-y) and nodev (-z)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target aix