Ensure network file system services are not in use

SedangLevel 1Otomatislinux

Deskripsi

The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q nfs-utils' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package nfs-utils is not installed' || { echo step1: missing 'package nfs-utils is not installed'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled nfs-server.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step3: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step3: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active nfs-server.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step3: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following command to stop nfs-server.service and remove nfs-utils package: # systemctl stop nfs-server.service # dnf remove nfs-utils - OR - - IF - the nfs-utils package is required as a dependency: Run the following commands to stop and mask the nfs-server.service: # systemctl stop nfs-server.service # systemctl mask nfs-server.service

Properti

Sistem operasi: rocky-8
Tag: cis-convertedlinux
Referensi: CIS Rocky Linux 8 Benchmark v3.0.0 - 2.1.9

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux