documentation_complete: true

title: 'Specify UID and GID for Anonymous NFS Connections'

description: |-
    To specify the UID and GID for remote root users, edit the <tt>/etc/exports</tt> file and add the following for each export:
    <pre>
    anonuid=<tt>value greater than UID_MAX from /etc/login.defs</tt>
    anongid=<tt>value greater than GID_MAX from /etc/login.defs</tt>
    </pre>
    Note that a value of "-1" is technically acceptable as this will randomize the <tt>anonuid</tt> and
    <tt>anongid</tt> values on a Red Hat Enterprise Linux 6 based NFS server. While acceptable from a security perspective,
    a value of <tt>-1</tt>  may cause interoperability issues, particularly with Red Hat Enterprise Linux 7 client systems.

rationale: |-
    Specifying the anonymous UID and GID ensures that the remote root user is mapped
    to a local account which has no permissions on the system.

severity: unknown

identifiers:
    cce: 27414-2

ocil_clause: 'anonuid or anongid are not set to a value greater than UID_MAX (for anonuid) and GID_MAX (for anongid)'

ocil: |-
    Inspect the mounts configured in <tt>/etc/exports</tt>. Each mount should specify a value
    greater than UID_MAX and GID_MAX as defined in /etc/login.defs.
