TMA-FLASHARRAY-3.1

Ensure NFS export policies restrict client access and enforce secure authentication (no wildcards, root squash, no sys auth)

CaoCấp 1Tự độngflasharray

Mô tả

NFS Export Policies are used to control access to any given file system export over any version of the NFS protocol. They can set properties such as permitted authentication mechanisms, allowance of root access from clients, and read-only vs. read-write based on client network identity. Fails when an NFS export rule uses the * client, auth_sys security or no-root-squash; confirm krb5i/krb5p and explicit client subnets. Note: a * client in any exported rule list (SMB included) also fails this check. The audit is a config_regex check against a text export of the Purity//FA CLI, supplied with --device-config. Capture it over SSH with the --nvp (name=value) output option, for example: ssh pureuser@<array> "purepolicy nfs rule list --nvp" > flasharray.txt (one file may hold the output of all commands used by this pack).

Cách kiểm tra

Phương pháp kiểm tra: Mẫu cấu hình

Mẫu khớp: (?im)(?:\bclient[ \t]*[=:]?[ \t]*\*(?:\s|$)|\bauth_sys\b|\bno-root-squash\b)

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To align with the security recommendations, update your NFS export policy rules to constrain client IPs, enforce root squash, and require Kerberos security. From the GUI: ; Navigate to Storage > Policies. ; In the Export Policies panel, click the name of the NFS policy to modify. ; In the Rules panel, click the + (Create Rule) icon to add a new, secure rule. (Note: Modifying existing NFS rules via the GUI is done by adding a new rule and removing the non-compliant one). ; Set the Client field to a specific IP subnet (e.g., 192.168.10.0/24). ; Select root-squash for the Access level. ; Select NFSv4 for the Version. ; Select krb5p (or krb5i) for Security, and ensure auth_sys is unchecked.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: flasharraystoragefile-services
Tham chiếu: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 3.1 Ensure NFS export policies restrict client access and enforce secure authentication (no wildcards, root squash, no sys auth)

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target flasharray