如何解決目標主機showmount -e信息泄露(CVE-1999-0554)

企業中，一般都會使用NFS網絡文件系統。最近筆者在項目上做等保測評的工作中，發現了一個“目標主機showmount -e信息泄露(CVE-1999-0554)“的問題。最終采取的解決措施如下：

1. 問題現狀

目前，我有三台主機，分別為主機a，主機b和主機c，其中主機a為服務器，部署了nfs，只允許主機b使用，然而主機c可以通過showmount -e命令來瀏覽主機a的目錄清單。

#主機a的nfs服務配置文件，其中10.28.7.210是主機b的IP地址
[root@a ~]# cat /etc/exports
/data  10.28.7.210/32(rw,sync)

#主機b使用showmount -e命令可以查看到的信息
[root@b ~]# showmount -e 10.28.7.253
Export list for 10.28.7.253:
/data 10.28.7.210/32
[root@b ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.28.7.210  netmask 255.255.255.0  broadcast 10.28.7.255

#主機c也可以使用showmount -e命令查看nfs服務器上共享出來的目錄信息
[root@c ~]# showmount -e 10.28.7.253 
Export list for 10.28.7.253:
/data 10.28.7.210/32
[root@c ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0C:29:62:18:E8  
          inet addr:10.28.7.252  Bcast:10.28.7.255  Mask:255.255.255.0

2. 解決方法

在NFS服務器上的/etc/hosts.allow和/etc/hosts.deny文件添加以下內容即可解決該問題。 

編輯/etc/hosts.allow文件

[root@a ~]# cat /etc/hosts.allow
#
# hosts.allow    This file contains access rules which are used to
#        allow or deny connections to network services that
#        either use the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
#
#
mountd:10.28.7.210    #<==添加客戶端IP地址，相當於白名單

 編輯/etc/hosts.deny文件

[root@a ~]# cat /etc/hosts.deny 
#
# hosts.deny    This file contains access rules which are used to
#        deny connections to network services that either use
#        the tcp_wrappers library or that have been
#        started through a tcp_wrappers-enabled xinetd.
#
#        The rules in this file can also be set up in
#        /etc/hosts.allow with a 'deny' option instead.
#
#        See 'man 5 hosts_options' and 'man 5 hosts_access'
#        for information on rule syntax.
#        See 'man tcpd' for information on tcp_wrappers
#
#
mountd:all    #<==添加該行，相當於黑名單

在以上兩個文件中添加對應內容之后，不需要重啟nfs服務，即可生效

3. 結果測試

#主機c使用showmount -e命令，無法查看相關信息
[root@c ~]# showmount -e 10.28.7.253 
rpc mount export: RPC: Authentication error; why = Failed (unspecified error)
[root@c ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0C:29:62:18:E8  
          inet addr:10.28.7.252  Bcast:10.28.7.255  Mask:255.255.255.0

#主機b使用正常
[root@b ~]# showmount -e 10.28.7.253
Export list for 10.28.7.253:
/data 10.28.7.210/32
[root@b ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.28.7.210  netmask 255.255.255.0  broadcast 10.28.7.255