UCF STIG Viewer Logo

The OS X system must be configured to disable the Network File System (NFS) daemon unless it is required.


Overview

Finding ID Version Rule ID IA Controls Severity
V-75991 AOSX-12-000141 SV-90679r1_rule Medium
Description
If the system does not require access to NFS file shares or is not acting as an NFS server, support for NFS is non-essential and NFS services must be disabled. NFS is a network file system protocol supported by UNIX-like operating systems. Enabling any service increases the attack surface for an intruder. By disabling unnecessary services, the attack surface is minimized.
STIG Date
Apple OS X 10.12 Security Technical Implementation Guide 2018-12-24

Details

Check Text ( C-75675r1_chk )
If the NFS daemon is required, this is not applicable.

To check if the NFS daemon is disabled, use the following command:

/usr/bin/sudo /bin/launchctl print-disabled system | /usr/bin/grep com.apple.nfsd

If the results do not show the following, this is a finding:

"com.apple.nfsd" => true
Fix Text (F-82629r1_fix)
To disable the NFS daemon, run the following command:

/usr/bin/sudo /bin/launchctl disable system/com.apple.nfsd

The system may need to be restarted for the update to take effect.