TMA-AIX-4.4.1.7
Ensure secure RPC authentication is enabled
Description
To enhance server-client authentication ensure that the secure option is selected for every export. RPC is a protocol used by NFS to communicate requests between hosts. Secure NFS uses encryption (DES or Kerberos) to secure host authentication in RPC transactions. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
Méthode de vérification
Méthode d'audit: Commande shell
command -v lsnfsexp >/dev/null 2>&1 || exit 1; out=$( { lsnfsexp | grep sec= | grep none; lsnfsexp | grep -v sec= ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Sortie attendue
compliant
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Use chnfsexp to change/validate this value for all NFS exported filesystems: chnfsexp -d <fs> -S <sec> The available security method options are: sys - UNIX authentication dh - DES authentication none - Use the anonymous ID if it has a value other than -1 krb5 - Kerberos. Authentication only krb5i - Kerberos. Authentication and integrity krb5p - Authentication, integrity, and privacy Once all exported filesystems have been successfully validated or changed, re-export the filesystems and directories to activate the new options: exportfs -a
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- aixnetwork
- Référence
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.1.7 Ensure secure RPC authentication is enabled
Vérifier cet hôte
Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.
tmaegis scan --target aix --level 2