Skip to content
ATO Pathways
  Log In

IBM AIX 7.x Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX systems access control program must be configured to grant or deny system access to specific hosts.

    &lt;VulnDiscussion&gt;If the system's access control program is not configured with appropriate rules for allowing and denying access to system net...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • All AIX files and directories must have a valid group owner.

    &lt;VulnDiscussion&gt;Failure to restrict system access to authenticated users negatively impacts operating system security.&lt;/VulnDiscussion&gt;...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX control scripts library search paths must contain only absolute paths.

    &lt;VulnDiscussion&gt;The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find librar...
    Rule Medium Severity
    Show

  • The global initialization file lists of preloaded libraries must contain only absolute paths on AIX.

    &lt;VulnDiscussion&gt;The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The local initialization file library search paths must contain only absolute paths on AIX.

    &lt;VulnDiscussion&gt;The library search path environment variable(s) contain a list of directories for the dynamic linker to search to find librar...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The local initialization file lists of preloaded libraries must contain only absolute paths on AIX.

    &lt;VulnDiscussion&gt;The library preload list environment variable contains a list of libraries for the dynamic linker to load before loading the ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX package management tool must be used daily to verify system software.

    &lt;VulnDiscussion&gt;Verification using the system package management tool can be used to determine that system software has not been tampered wit...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX DHCP client must not send dynamic DNS updates.

    &lt;VulnDiscussion&gt;Dynamic DNS updates transmit unencrypted information about a system including its name and address and should not be used unl...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must not run any routing protocol daemons unless the system is a router.

    &lt;VulnDiscussion&gt;Routing protocol daemons are typically used on routers to exchange network topology information with other routers. If this s...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must not process ICMP timestamp requests.

    &lt;VulnDiscussion&gt;The processing of Internet Control Message Protocol (ICMP) timestamp requests increases the attack surface of the system.&lt;...
    Rule Medium Severity
    Show

  • The AIX root user home directory must not be the root directory (/).

    &lt;VulnDiscussion&gt;Changing the root home directory to something other than / and assigning it a 0700 protection makes it more difficult for int...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00230

    <GroupDescription></GroupDescription>
    Group
    Show

  • All AIX interactive users must be assigned a home directory in the passwd file and the directory must exist.

    &lt;VulnDiscussion&gt;All users must be assigned a home directory in the passwd file. Failure to have a home directory may result in the user being...
    Rule Medium Severity
    Show

  • SRG-OS-000105-GPOS-00052

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX operating system must use Multi Factor Authentication.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor aut...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX operating system must be configured to authenticate using Multi Factor Authentication.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor aut...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX operating system must be configured to use Multi Factor Authentication for remote connections.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor aut...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX /etc/hosts file must be group-owned by system.

    &lt;VulnDiscussion&gt;Unauthorized group ownership of the /etc/hosts file can lead to the ability for a malicious actor to redirect traffic to serv...
    Rule Medium Severity
    Show

  • AIX must have the have the PowerSC Multi Factor Authentication Product configured.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor aut...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX operating system must be configured to use a valid server_ca.pem file.

    &lt;VulnDiscussion&gt;To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor aut...
    Rule Medium Severity
    Show

  • SRG-OS-000376-GPOS-00161

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX operating system must accept and verify Personal Identity Verification (PIV) credentials.

    &lt;VulnDiscussion&gt;The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DoD has mandated the use...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.

    &lt;VulnDiscussion&gt;Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It al...
    Rule Medium Severity
    Show

  • SRG-OS-000342-GPOS-00133

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must be configured so that the audit system takes appropriate action when the audit storage volume is full.

    &lt;VulnDiscussion&gt;Taking appropriate action in case of a filled audit storage volume will minimize the possibility of losing audit records.&lt;...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX /etc/hosts file must be owned by root.

    &lt;VulnDiscussion&gt;Unauthorized ownership of the /etc/hosts file can lead to the ability for a malicious actor to redirect traffic to servers of...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX /etc/hosts file must have a mode of 0640 or less permissive.

    &lt;VulnDiscussion&gt;Unauthorized permissions of the /etc/hosts file can lead to the ability for a malicious actor to redirect traffic to servers ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX cron and crontab directories must have a mode of 0640 or less permissive.

    &lt;VulnDiscussion&gt;Incorrect permissions of the cron or crontab directories could permit unauthorized users the ability to alter cron jobs and r...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX /etc/syslog.conf file must be owned by root.

    &lt;VulnDiscussion&gt;Unauthorized ownership of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules