Ensure NFS client mounts include nosuid and nodev options

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

command -v lsnfsmnt >/dev/null 2>&1 || exit 1; out=$( { lsnfsmnt -l | egrep -v "^Name" | grep -v nosuid; lsnfsmnt -l | egrep -v "^Name" | grep -v nodev ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For each NFS mount, disable suid programs and device access. List the current NFS mounts: lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nosuid" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done lsnfsmnt -l | /usr/bin/egrep -v "^Name" | /usr/bin/grep -v "nodev" | while read remote server mntpnt rest; do chnfsmnt -d ${remote} -f ${mntpnt} -h ${server} -y -z done NOTE: The NFS mount needs is re-mounted automatically by chnfsmnt. NOTE: The second loop might not do anything as both loops set both nosuid (-y) and nodev (-z)

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aix