Solaris 10 X86 Security Technical Implementation Guide

The Solaris 10 X86 Security Technical Implementation Guide (V2 R4) has 513 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

513STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Thu Jan 26 2023

The system's NFS export configuration must not have the sec option set to none (or equivalent); additionally, the default authentication must not to be set to none.

Solaris 10 X86 Security Technical Implementation Guide

Assessment Title

Rule Text

The system's NFS export configuration must not have the sec option set to none (or equivalent); additionally, the default authentication must not to be set to none.

Description

Discussion Text

If sec=none on Solaris, all NFS requests are mapped to an unknown/common user instead of being processed according to the provided UID.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-227920

Rule

SV-227920r603266_rule

Severity

medium

Rule Version

GEN005860

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Perform the following on NFS servers:

# grep "^default" /etc/nfssec.conf

Check to ensure the second column does not equal 0. This would indicate the default is set to none. Perform the following to check currently exported file systems.

# more /etc/dfs/dfstab

If the option sec=none is set on any of the exported file systems, this is a finding.

Implementation Procedure

Fix Text

Edit the /etc/dfs/dfstab file and add the sec=XXX option to the share line as an option.  XXX must be a valid option for the system other than none.

STIG check 443 of 513 in the Solaris 10 X86 STIG checklist

← Previous · V-227919The NFS anonymous UID and GID must be configured to values that have no permissions.Next · V-227921 →The NFS server must not allow remote root access.