The Network File System (NFS) anonymous UID and GID must be configured to values without permissions.

From Oracle Linux 5 Security Technical Implementation Guide

Associated with: CCI-000062

SV-64169r1_rule The Network File System (NFS) anonymous UID and GID must be configured to values without permissions.

Vulnerability discussion

When an NFS server is configured to deny remote root access, a selected UID and GID are used to handle requests from the remote root user. The UID and GID should be chosen from the system to provide the appropriate level of non-privileged access.

Check content

Check if the 'anonuid' and 'anongid' options are set correctly for exported file systems. List exported filesystems: # exportfs -v Each of the exported file systems should include an entry for the 'anonuid=' and 'anongid=' options set to "-1" or an equivalent (60001, 65534, or 65535). If appropriate values for 'anonuid' or 'anongid' are not set, this is a finding.

Fix text

Edit "/etc/exports" and set the "anonuid=-1" and "anongid=-1" options for exports lacking it. Re-export the filesystems.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.