nerdexam
CompTIA

CAS-002 · Question #834

After reviewing a company's NAS configuration and file system access logs, the auditor is advising the security administrator to implement additional security controls on the NFS export. The…

The correct answer is C. Users with root access on remote NFS client computers can always use the SU command to. Removing no_root_squash enables the NFS default that maps remote root to an anonymous user, and nosuid blocks SUID-based privilege escalation, but a user with local root on the client can still use 'su' to assume any UID and access NFS files by that identity.

Technical Integration of Enterprise Components

Question

After reviewing a company's NAS configuration and file system access logs, the auditor is advising the security administrator to implement additional security controls on the NFS export. The security administrator decides to remove the no_root_squash directive from the export and add the nosuid directive. Which of the following is true about the security controls implemented by the security administrator?

Options

  • AThe newly implemented security controls are in place to ensure that NFS encryption can only be
  • BRemoving the no_root_squash directive grants the root user remote NFS read/write access to
  • CUsers with root access on remote NFS client computers can always use the SU command to
  • DAdding the nosuid directive disables regular users from accessing files owned by the root user

How the community answered

(53 responses)
  • A
    6% (3)
  • B
    2% (1)
  • C
    81% (43)
  • D
    11% (6)

Why each option

Removing no_root_squash enables the NFS default that maps remote root to an anonymous user, and nosuid blocks SUID-based privilege escalation, but a user with local root on the client can still use 'su' to assume any UID and access NFS files by that identity.

AThe newly implemented security controls are in place to ensure that NFS encryption can only be

Removing no_root_squash and adding nosuid are NFS access control export directives governing privilege mapping and SUID binary execution; they do not configure or enforce NFS transport or data encryption.

BRemoving the no_root_squash directive grants the root user remote NFS read/write access to

Removing the no_root_squash directive enables root squashing - the NFS default behavior that maps the remote root user to an unprivileged anonymous account - which restricts root access on the server rather than granting it.

CUsers with root access on remote NFS client computers can always use the SU command toCorrect

NFS performs access control based on UID and GID numbers rather than usernames; a user with root access on an NFS client can run 'su' to assume any UID present on that client system, and because NFS trusts client-supplied UIDs, they effectively impersonate that user and gain read or write access to NFS files owned by that UID - a residual risk that neither root_squash nor nosuid eliminates.

DAdding the nosuid directive disables regular users from accessing files owned by the root user

The nosuid directive prevents SUID and SGID bits from taking effect on the NFS-mounted filesystem, blocking privilege escalation via setuid binaries, but it does not prevent users from accessing files owned by root when the file's standard read or execute permissions allow it.

Concept tested: NFS root squash and nosuid export security directives

Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/storage_administration_guide/nfs-serverconfig

Topics

#NFS security#root squash#nosuid#file system permissions

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice