Ensure root squash for NFS file shares is configured (Classic File Shares)

高レベル 1手動レビューazure

説明

Note: This recommendation applies to Classic File Shares (Azure file shares hosted in a storage account, the Microsoft.Storage provider). Permissions for NFS file shares are enforced by the client OS rather than by the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients. Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines are not fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker cannot exploit root privileges to access or modify critical files on the N...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Audit from Azure Portal 1. Go to Storage accounts. 2. For each storage account with NFS file shares, under Data storage, click File shares. 3. Click the name of an NFS file share. 4. Click Properties. 5. Under ROOT SQUASH, ensure that Root Squash is selected. 6. Repeat steps 1-5 for each NFS file share in each storage account. Audit from Azure CLI Run the following command to list storage accounts: az storage account list --query "[].{name:name, resourceGroup:resourceGroup}" --output table For each storage account, run the following command to list its file shares with their protocol and root squash settings (the management-plane share-rm command returns rootSquash; the data-plane share list command does not): az storage share-rm list --resource-group <resource-group> --storage-account <storage-account> --query "[].{name:name, enabledProtocols:enabledProtocols, rootSquash:rootSquash}" --output table For each NFS file share (enabledProtocols is NFS), ensure that rootSquash is set to RootSquash. To view a single share's setting, run: az storage share-rm show --resource-group <resource-group> --storage-account <storage-account> --name <file-share-name> --query rootSquash Audit from...

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remediate from Azure Portal 1. Go to Storage accounts. 2. For each storage account with NFS file shares, under Data storage, click File shares. 3. Click the name of an NFS file share. 4. Click Properties. 5. Under ROOT SQUASH, select Root Squash from the drop-down menu. 6. Click Save. 7. Repeat steps 1-6 for each NFS file share requiring remediation in each storage account. Remediate from Azure CLI For each NFS file share requiring remediation, run the following command to enable root squash: az storage share-rm update --resource-group <resource-group> --storage- account <storage-account> --name <nfs-file-share> --root-squash RootSquash Remediate from PowerShell For each NFS file share requiring remediation, run the following command to enable root squash: Update-AzRmStorageShare -ResourceGroupName <resource-group> - StorageAccountName <storage-account> -Name <nfs-file-share> -RootSquash RootSquash

プロパティ

オペレーティングシステム: すべて
タグ: azurecloudstorage
参照: CIS Microsoft Azure Storage Services Benchmark v2.0.0 - 7.2.4 Ensure root squash for NFS file shares is configured (Classic File Shares)