Title

Any NIS+ server must be operating at security level 2. (Cat II impact)

Discussion

If the NIS+ server is not operating in, at least, security level 2, there is no encryption and the system could be penetrated by intruders and/or malicious users.

Check Content

If the system is not using NIS+, this is not applicable. Check the system to determine if NIS+ security level 2 is implemented. Procedure: # niscat cred.org_dir If the second column does not contain DES, the system is not using NIS+ security level 2, and this is a finding.

Fix Text

Ensure the NIS+ server is operating at security level 2 by editing /usr/lib/nis/nisserver and ensuring the line containing SEC= is set to the numeral 2, for example: SEC=2 # 2=DES or 3=RSA Security Level 0 is designed for testing and initial setup of the NIS+ namespace. When running at level 0, the daemon does not enforce access control. Any client is allowed to perform any operation, including updates and deletions. Security level 1 accepts AUTH_SYS and AUTH_DES credentials for authenticating clients and authorizing them to perform NIS+ operations. This is not a secure mode of operation since AUTH_SYS credentials are easily forged. It should not be used on networks in which any untrusted user may potentially have access. Security level 2 accepts only AUTH_DES credentials for authentication and authorization. This is the highest level of security currently provided by the NIS+ service and the default security level if the -S option is not used.

Additional Identifiers

Rule ID: SV-28453r1_rule

Vulnerability ID: V-926

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.