Solaris 10 SPARC Security Technical Implementation Guide

The Solaris 10 SPARC Security Technical Implementation Guide (V2 R4) has 507 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

507STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Thu Jan 26 2023

The NFS anonymous UID and GID must be configured to values that have no permissions.

Solaris 10 SPARC Security Technical Implementation Guide

Assessment Title

Rule Text

The NFS anonymous UID and GID must be configured to values that have no permissions.

Description

Discussion Text

When an NFS server is configured to deny remote root access, a selected UID and GID are used to handle requests from the remote root user. The UID and GID should be chosen from the system to provide the appropriate level of non-privileged access.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-227012

Rule

SV-227012r603265_rule

Severity

medium

Rule Version

GEN005820

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check if the anon option is set correctly for exported file systems.

List exported file systems.
# exportfs -v
OR
# more /etc/dfs/sharetab

Each of the exported file systems should include an entry for the 'anon=' option set to -1 or an equivalent (60001, 60002, 65534, or 65535). If an appropriate 'anon=' setting is not present for an exported file system, this is a finding.

Implementation Procedure

Fix Text

Edit /etc/dfs/dfstab and add the "anon=-1" option for exports lacking it.  Re-export the filesystems.

STIG check 437 of 507 in the Solaris 10 SPARC STIG checklist

← Previous · V-227011All NFS exported system files and system directories must be group-owned by root, bin, or sys.Next · V-227013 →The system's NFS export configuration must not have the sec option set to none (or equivalent); additionally, the default authentication must not to be set to none.