Cis Azure Storage 8.2

8.2 Ensure root squash for NFS file shares is configured (Automated)

Description

Permissions for NFS file shares are enforced by the client OS rather than by the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients.

Rationale

Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines are not fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker cannot exploit root privileges to access or modify critical files on the NFS server.

Impact

There is no additional cost associated with enabling root squash; however, there may be some minor administrative overhead involved in configuring and managing permissions with root squash enabled.

Audit Procedure

Audit from Azure Portal

1. Go to Storage accounts.
2. For each storage account with NFS file shares, under Data storage, click File shares.
3. Click the name of an NFS file share.
4. Click Properties.
5. Under ROOT SQUASH, ensure that Root Squash is selected.
6. Repeat steps 1-5 for each NFS file share in each storage account.

Audit from Azure CLI

Run the following command to list storage accounts:

az storage account list

For each storage account, run the following command to list file shares:

az storage share list --account-name <storage-account>

For each file share with "protocols": [ "NFS" ], ensure that rootSquash is set to RootSquash.

Audit from PowerShell

Run the following command to list storage accounts:

Get-AzStorageAccount -ResourceGroupName <resource-group>

For each storage account, run the following command to list file shares:

Get-AzRmStorageShare -ResourceGroupName <resource-group> -StorageAccountName <storage-account>

For each NFS file share, run the following command to get the root squash configuration:

Get-AzRmStorageShare -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -Name <nfs-file-share> | fl -Property RootSquash

Ensure that RootSquash is set to RootSquash.

Expected Result

Root squash is set to RootSquash for all NFS file shares.

Remediation

Remediate from Azure Portal

1. Go to Storage accounts.
2. For each storage account with NFS file shares, under Data storage, click File shares.
3. Click the name of an NFS file share.
4. Click Properties.
5. Under ROOT SQUASH, select Root Squash from the drop-down menu.
6. Click Save.
7. Repeat steps 1-6 for each NFS file share requiring remediation in each storage account.

Remediate from Azure CLI

For each NFS file share requiring remediation, run the following command to enable root squash:

az storage share-rm update --resource-group <resource-group> --storage-account <storage-account> --name <nfs-file-share> --root-squash RootSquash

Remediate from PowerShell

For each NFS file share requiring remediation, run the following command to enable root squash:

Update-AzRmStorageShare -ResourceGroupName <resource-group> -StorageAccountName <storage-account> -Name <nfs-file-share> -RootSquash RootSquash

Default Value

Root squash is disabled by default on NFS Azure file shares.

References

1. https://learn.microsoft.com/en-us/azure/storage/files/nfs-root-squash
2. https://learn.microsoft.com/en-us/cli/azure/storage/account
3. https://learn.microsoft.com/en-us/cli/azure/storage/share
4. https://learn.microsoft.com/en-us/cli/azure/storage/share-rm
5. https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azstorageaccount
6. https://learn.microsoft.com/en-us/powershell/module/az.storage/get-azrmstorageshare
7. https://learn.microsoft.com/en-us/powershell/module/az.storage/update-azrmstorageshare

Additional Information

There are three root squash settings:

• No root squash: Turn off root squashing. This option is mainly useful for diskless clients or workloads as specified by workload documentation. This is the default setting when creating a new NFS Azure file share.
• All squash: Map all UIDs and GIDs to the anonymous user. This is useful for shares that require read-only access by all clients.
• Root squash: Map requests from UID/GID 0 (root) to the anonymous UID/GID. This does not apply to any other UIDs or GIDs that might be equally sensitive, such as the user bin or group staff.

All squash may be appropriate for highly restricted environments where no client-side user (including root) should have specific privileges on the NFS file share.

Profile

Level 1 | Automated