[ Applies to ] StorageGuard / Nasuni / Cloud Storage & STaaS
This article lists the recommended baseline checks for Nasuni. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
Nasuni is a cloud-native file data platform that combines cloud object storage with Nasuni Edge Appliances to deliver a global file system across locations, with built-in snapshots and global file locking.
Why hardening Nasuni matters
Nasuni often serves as the authoritative file system across sites, storing user files, engineering data and regulated content. Encryption, share and volume permissions, secure remote access and centralized monitoring protect that data, because a single incident can affect every site.
Recommended baseline checks
The baseline below contains 54 checks, listed alphabetically.
| ID | Configuration check |
|---|---|
| SG-F8097T239V01 | Anonymous user access - FTP |
| SG-C0454T239V01 | Antivirus status |
| SG-C0449T239V01 | Approved DNS servers |
| SG-C0013T239V01 | Approved NTP servers |
| SG-C0001T239V01 | Audit logging status |
| SG-C0193T239V02 | Browsable file shares (NFS SMB) |
| SG-C0187T239V01 | CIFS SMB allowed access list |
| SG-C0128T239V01 | CIFS SMB anonymous user access restriction |
| SG-C0189T239V01 | CIFS SMB denied access list |
| SG-C0343T239V01 | CIFS SMB encryption (policy) |
| SG-C0122T239V01 | CIFS SMB version enabled |
| SG-C0098T239V01 | Data retention period |
| SG-C0243T239V01 | DNS server configuration |
| SG-C0060T239V01 | DNS server redundancy |
| SG-F4533T239V01 | Encryption key length |
| SG-C0175T239V01 | Event types enabled for audit logging |
| SG-C0563T239V01 | FTP directory file visibility permissions |
| SG-F6272T239V01 | FTP directory Group ACL |
| SG-F4696T239V01 | FTP directory new file/folder permissions ("umask") |
| SG-F5684T239V01 | FTP directory read only access |
| SG-F2950T239V01 | Global file lock status |
| SG-C0209T239V02 | Idle session timeout |
| SG-F4595T239V01 | Multi protocol volume permissions policy |
| SG-C0191T239V01 | NFS export ACL status |
| SG-C0562T239V01 | NFS export data integrity |
| SG-C0561T239V01 | NFS export global read only |
| SG-C0560T239V01 | NFS export security protocol |
| SG-C0377T239V01 | NFS root squash status |
| SG-C0171T239V01 | NTP server configuration |
| SG-C0432T239V01 | NTP server redundancy |
| SG-C0138T239V01 | Remote support status |
| SG-F5820T239V01 | Required DNS servers |
| SG-F9295T239V01 | Required NTP servers |
| SG-C0553T239V02 | Secure FTP enabled - Client |
| SG-C0553T239V01 | Secure FTP enabled - Filer |
| SG-F4680T239V01 | Shared SMB link allow read write ACL |
| SG-F8619T239V01 | Shared SMB link creation permissions |
| SG-F9507T239V01 | Shared SMB link deny ACL |
| SG-F4025T239V01 | Shared SMB link maximum lifetime (days) |
| SG-C0558T239V01 | Shared SMB links password protection |
| SG-C0555T239V01 | SMB hide sensitive files |
| SG-C0557T239V01 | SMB hide snapshots |
| SG-C0556T239V01 | SMB read only share |
| SG-F4732T239V01 | SMB share allow read write ACL |
| SG-C0559T239V01 | SMB share limited authentication |
| SG-C0058T239V01 | SNMP community default string |
| SG-C0123T239V01 | SNMP versions enabled |
| SG-C0346T239V01 | SNMPv3 user security |
| SG-C0019T239V01 | Target OS version |
| SG-C0564T239V01 | Unauthenticated file access |
| SG-F1853T239V01 | Volume file protocol permission policy |
| SG-C0554T239V01 | Volume remote access |
| SG-F1959T239V01 | Volume remote access - filer permissions |
| SG-F2551T239V01 | Writable Shared SMB link |
Related components
A complete baseline also covers the components that manage, connect to or protect Nasuni. Review the configuration of:
- Nasuni Management Console (NMC)
- Cloud object storage accounts
- Nasuni Access Anywhere
Run checks with StorageGuard
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.