documentation_complete: true

title: 'Restrict NFS Clients to Privileged Ports'

description: |-
    By default, the server NFS implementation requires that all client requests be made
    from ports less than 1024. If your organization has control over systems connected to its
    network, and if NFS requests are prohibited at the border firewall, this offers some protection
    against malicious requests from unprivileged users. Therefore, the default should not be changed.
    <br /><br />
    To ensure that the default has not been changed, ensure no line in
    <tt>/etc/exports</tt> contains the option <tt>insecure</tt>.

rationale: |-
    Allowing client requests to be made from ports higher than 1024 could allow a unprivileged
    user to initiate an NFS connection. If the unprivileged user account has been compromised, an
    attacker could gain access to data on the NFS server.

severity: unknown

identifiers:
    cce: 27121-3
