documentation_complete: true

title: 'Use Root-Squashing on All Exports'

description: |-
    If a filesystem is exported using root squashing, requests from root on the client
    are considered to be unprivileged (mapped to a user such as nobody). This provides some mild
    protection against remote abuse of an NFS server. Root squashing is enabled by default, and
    should not be disabled.
    <br /><br />
    Ensure that no line in <tt>/etc/exports</tt> contains the option <tt>no_root_squash</tt>.

rationale: |-
    If the NFS server allows root access to local file systems from remote hosts, this
    access could be used to compromise the system.

severity: unknown

identifiers:
    cce: 27138-7
