Ensure NFS client mounts include nosuid and nodev options

Cara pemeriksaan

Metode audit: Perintah shell

command -v lsnfsmnt >/dev/null 2>&1 || exit 1; out=$( { lsnfsmnt -l | egrep -v "^Name" | grep -v nosuid; lsnfsmnt -l | egrep -v "^Name" | grep -v nodev ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

For each NFS mount, disable suid programs and device access. List the current NFS mounts: lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nosuid" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nodev" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done NOTE: The NFS mount needs is re-mounted automatically by chnfsmnt. NOTE: The second loop might not do anything as both loops set both nosuid (-y) and nodev (-z)

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target aix