Ensure NFS exports use allow lists

보통레벨 2자동aix

설명

Only allow explicitly defined host access to NFS exported filesystems and directories. The NFS server should be configured to only allow explicitly defined hosts to mount filesystems from the server. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

점검 방법

감사 방식: 셸 명령

shell

command -v showmount >/dev/null 2>&1 || exit 1; n=$(showmount -e 2>/dev/null | grep -c "(everyone)"); echo "$n"

예상 출력: 0

조치 방법

조치 방식: 가이드 또는 인프라 패치

Ensure that all exports defined in /etc/exports have explicit client access options which clearly define the host or hosts allowed access: Review the content of /etc/exports and that all exports have explicit access lists: showmount -e | grep "(everyone)" Ensure that each NFS export has an explicit access line, for example, modify: /export/repo (everyone) to: /export/repo x071 The option -c is used to specify clients permitted access: chnfsexp -d /export/repo -c x071

속성

운영 체제: 모두
태그: aixnetwork
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.4.1.5 Ensure NFS exports use allow lists

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix --level 2