Ensure network file system services are not in use

MédiaNível 1Automatizadalinux

Descrição

The Network File System (NFS) is one of the first and most widely distributed file systems in the UNIX environment. It provides the ability for systems to mount file systems of other servers through the network.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { command -v rpm >/dev/null 2>&1 || { echo "step1: rpm not installed"; return 1; }; o=$(bash -c 'rpm -q nfs-utils' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'package nfs-utils is not installed' || { echo step1: missing 'package nfs-utils is not installed'; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step2: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step2: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-enabled nfs-server.service 2>/dev/null | grep '"'"'enabled'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; command -v grep >/dev/null 2>&1 || { echo "step3: grep not installed"; return 1; }; command -v systemctl >/dev/null 2>&1 || { echo "step3: systemctl not installed"; return 1; }; o=$(bash -c 'systemctl is-active nfs-server.service 2>/dev/null | grep '"'"'^active'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step3: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Run the following command to stop nfs-server.service and remove nfs-utils package: # systemctl stop nfs-server.service # dnf remove nfs-utils - OR - - IF - the nfs-utils package is required as a dependency: Run the following commands to stop and mask the nfs-server.service: # systemctl stop nfs-server.service # systemctl mask nfs-server.service

Propriedades

Sistemas operacionais: rocky-9
Tags: cis-convertedlinux
Referência: CIS Rocky Linux 9 Benchmark v3.0.0 - 2.1.10

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux