cis-azure-storage-8-2

name	cis-azure-storage-8.2
description	Ensure root squash for NFS file shares is configured
category	cis-azure-storage
version	1.0.0
author	cyberstrike-official
tags	["cis","azure","storage","azure-files","nfs","soft-delete"]
cis_id	8.2
cis_benchmark	CIS Microsoft Azure Storage Services Benchmark v1.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

8.2 Ensure root squash for NFS file shares is configured (Automated)

Description

Permissions for NFS file shares are enforced by the client OS rather than by the Azure Files service. Root squash is an administrative security feature in NFS that prevents unauthorized root-level access to the NFS server by client machines. This functionality is an important part of protecting user data and system settings from manipulation by untrusted or compromised clients.

Rationale

Administrators should enable root squash in environments where multiple users or systems access the NFS share, especially in scenarios where client machines are not fully trusted. By converting root users to anonymous users, root squash ensures that even if a client machine is compromised, the attacker cannot exploit root privileges to access or modify critical files on the NFS server.

Impact

There is no additional cost associated with enabling root squash; however, there may be some minor administrative overhead involved in configuring and managing permissions with root squash enabled.

Audit Procedure

Audit from Azure Portal

1. Go to Storage accounts.
2. For each storage account with NFS file shares, under Data storage, click File shares.
3. Click the name of an NFS file share.
4. Click Properties.
5. Under ROOT SQUASH, ensure that Root Squash is selected.
6. Repeat steps 1-5 for each NFS file share in each storage account.

Audit from Azure CLI

Run the following command to list storage accounts:

az storage account list

For each storage account, run the following command to list file shares:

az storage share list --account-name <storage-account>

For each file share with "protocols": [ "NFS" ], ensure that rootSquash is set to RootSquash.

Audit from PowerShell

Run the following command to list storage accounts:

Get-AzStorageAccount -ResourceGroupName <resource-group>

For each storage account, run the following command to list file shares:

Get-AzRmStorageShare -ResourceGroupName <resource-group> -StorageAccountName <storage-account>

For each NFS file share, run the following command to get the root squash configuration: