IBM AIX 7.x Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
AIX must enforce the limit of three consecutive invalid login attempts by a user before the user account is locked and released by an administrator.
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking...Rule Medium Severity -
SRG-OS-000027-GPOS-00008
Group -
SRG-OS-000104-GPOS-00051
Group -
All accounts on AIX must be assigned unique User Identification Numbers (UIDs) and must authenticate organizational and non-organizational users (or processes acting on behalf of these users).
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Lack of authenticat...Rule High Severity -
SRG-OS-000104-GPOS-00051
Group -
The AIX SYSTEM attribute must not be set to NONE for any account.
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational user...Rule High Severity -
SRG-OS-000109-GPOS-00056
Group -
Direct logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.
Shared accounts (accounts where two or more people log in with the same user identification) do not provide identification and authentication. There is no way to provide for non-repudiation or indi...Rule Medium Severity -
SRG-OS-000112-GPOS-00057
Group -
AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
A replay attack may enable an unauthorized user to gain access to the operating system. Authentication sessions between the authenticator and the operating system validating the user credentials mu...Rule High Severity -
SRG-OS-000001-GPOS-00001
Group -
The shipped /etc/security/mkuser.sys file on AIX must not be customized directly.
The "/etc/security/mkuser.sys" script customizes the new user account when a new user is created, or a user is logging into the system without a home directory. An improper "/etc/security/mkuser.sy...Rule Medium Severity -
SRG-OS-000001-GPOS-00001
Group -
The regular users default primary group must be staff (or equivalent) on AIX.
The /usr/lib/security/mkuser.default file contains the default primary groups for regular and admin users. Setting a system group as the regular users' primary group increases the risk that the reg...Rule Medium Severity -
SRG-OS-000259-GPOS-00100
Group -
All system files, programs, and directories must be owned by a system account.
Restricting permissions will protect the files from unauthorized modification.Rule Medium Severity -
SRG-OS-000259-GPOS-00100
Group -
AIX device files and directories must only be writable by users with a system account or as configured by the vendor.
System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.Rule Medium Severity -
SRG-OS-000114-GPOS-00059
Group -
AIX must configure the ttys value for all interactive users.
A user's "ttys" attribute controls from which device(s) the user can authenticate and log in. If the "ttys" attribute is not specified, all terminals can access the user account.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.