The Linux NFS Server must not have the insecure file locking option.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4339	GEN000000-LNX00560	SV-4339r2_rule	IAIA-1 IAIA-2	High

Description
Insecure file locking could allow for sensitive data to be viewed or edited by an unauthorized user.

STIG	Date
VMware ESX 3 Server	2016-05-13

Details

Check Text ( C-2150r2_chk )
Determine if an NFS server is running on the system by: # ps –ef |grep nfsd If an NFS server is running, confirm that it is not configured with the insecure_locks option by: # exportfs –v The example below would be a finding: /misc/export speedy.example.com(rw,insecure_locks)

Fix Text (F-4250r3_fix)
Remove the "insecure_locks" option from all NFS exports on the system. Procedure: Edit /etc/exports and remove all instances of the insecure_locks option. Re-export the file systems to make the setting take effect. # exportfs -a