The NFS server must not have the all_squash option enabled.

From Red Hat Enterprise Linux 6 Security Technical Implementation Guide

Associated with: CCI-000764

SV-50260r1_rule The NFS server must not have the all_squash option enabled.

Vulnerability discussion

The "all_squash" option maps all client requests to a single anonymous uid/gid on the NFS server, negating the ability to track file access by user ID.

Check content

If the NFS server is read-only, in support of unrestricted access to organizational content, this is not applicable. The related "root_squash" option provides protection against remote administrator-level access to NFS server content. Its use is not a finding. To verify the "all_squash" option has been disabled, run the following command: # grep all_squash /etc/exports If there is output, this is a finding.

Fix text

Remove any instances of the "all_squash" option from the file "/etc/exports". Restart the NFS daemon for the changes to take effect. # service nfs restart

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.