Title

The NFS server must not allow remote root access. (Cat II impact)

Discussion

If the NFS server allows root access to local file systems from remote hosts, this access could be used to compromise the system.

Check Content

Determine if the NFS server is exporting with the root access option. Procedure: # exportfs -v | grep "root=" OR # more /etc/dfs/sharetab If an export with the root option is found and is not properly documented with the IA staff, this is a finding.

Fix Text

Edit the /etc/dfs/dfstab file and remove the root= option from all exports. Re-export the file systems.

Additional Identifiers

Rule ID: SV-227921r603266_rule

Vulnerability ID: V-227921

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.