The nobody access for RPC encryption key storage service must be disabled.
An XCCDF Rule
Description
<VulnDiscussion>If login by the user "nobody" is allowed for secure RPC, there is an increased risk of system compromise. If keyserv holds a private key for the "nobody" user, it will be used by key_encryptsession to compute a magic phrase which can be easily recovered by a malicious user.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-216350r959010_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Determine if the rpc-authdes package is installed:
# pkg list solaris/legacy/security/rpc-authdes
If the output of this command is: