mediumfilesystemverified ✓

Ensure nodev option on NFS mounts

mount-nfs-nodev · RHEL ≥ 8 · 1 impl

Description

The nodev mount option must be set on all NFS mounts to prevent device special files from being used across the network.

Rationale

NFS mounts from untrusted or compromised servers could contain device files. The nodev option prevents interpretation of device special files on NFS-mounted filesystems, reducing the attack surface.

Check → Remediate

Checkcommand

grep -E '\snfs[0-9]?\s' /proc/mounts 2>/dev/null | grep -v 'nodev' | head -1

Remediatemanual

note:: Add the nodev option to all NFS mount entries in /etc/fstab. Example: server:/share /mnt/nfs nfs defaults,nodev,nosuid 0 0

Framework references

STIG

V-281228 / RHEL-10-700100V-257854 / RHEL-09-231065V-230307

NIST 800-53

CM-6AC-3

Live verification

rhel8:check

#mount#nfs#nodev#network#hardening