IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
also occur even without a query during booting. Therefore, an early check
for correctness must be made of such a file.
- The /etc/exports and /etc/fstab files (or similar files on other systems) are
system files to which only the system administrator may have access.
- File systems to be exported should be installed on a separate disk or
partition so that, for instance, a user will be prevented from filling the
system disk by writing without authorisation.
- For mounting of exported file systems, the nosuid option must be used in
order to prevent execution of suid programs on the client.
- Where possible, the NFS daemon should be configured in such a way that
it will automatically carry out a check of the port numbers in order to
ensure that only packets from the privileged ports 0 - 1023 will be
accepted.
- For identification of files, so-called file handles are used between client
and server, which can be guessed easily. Therefore, they should be
randomised by means of the fsirand programme.
- Where available, SECURE NFS should be used to ensure that data will be
transmitted in encrypted form. In this respect, the following steps are
important:
- - generation of keys for all NFS users;
- - deletion of the public key for the user nobody;
- - rpc.ypupdated must not be run on the NIS master server;
- - transfer of the public key map to all computers before SECURE NFS
is started;
- - use of keylogin and keylogout for the generation and deletion of
private keys when logging in and out;
- - the keyserv daemon must be run on every client;
- - the secure option must be used for mounting;
- - the clocks in all computers must be synchronised since the
transmitted packets are provided with timing marks in order to
prevent replay of messages.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000