Skip to content
ATO Pathways
  Log In

IBM AIX 7.x Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX NFS server must be configured to restrict file system access to local hosts.

    &lt;VulnDiscussion&gt;The NFS access option limits user access to the specified level. This assists in protecting exported file systems. If access ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00230

    <GroupDescription></GroupDescription>
    Group
    Show

  • All AIX users home directories must have mode 0750 or less permissive.

    &lt;VulnDiscussion&gt;Excessive permissions on home directories allow unauthorized access to user files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&g...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00230

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX user home directories must not have extended ACLs.

    &lt;VulnDiscussion&gt;Excessive permissions on home directories allow unauthorized access to user files.&lt;/VulnDiscussion&gt;&lt;FalsePositives&g...
    Rule Medium Severity
    Show

  • SRG-OS-000312-GPOS-00124

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must use Trusted Execution (TE) Check policy.

    &lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have di...
    Rule Medium Severity
    Show

  • SRG-OS-000365-GPOS-00152

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must disable trivial file transfer protocol.

    &lt;VulnDiscussion&gt;Without auditing the enforcement of access restrictions against changes to the application configuration, it will be difficul...
    Rule High Severity
    Show

  • SRG-OS-000368-GPOS-00154

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX global initialization files must contain the mesg -n or mesg n commands.

    &lt;VulnDiscussion&gt;Command "mesg -n" allows only the root user the permission to send messages to your workstation to avoid having others clutte...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.

    &lt;VulnDiscussion&gt;Control of program execution is a mechanism used to prevent execution of unauthorized programs. Some operating systems may pr...
    Rule Medium Severity
    Show

  • SRG-OS-000437-GPOS-00194

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must remove all software components after updated versions have been installed.

    &lt;VulnDiscussion&gt;Previous versions of software components that are not removed from the information system after updates have been installed m...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00226

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX must enforce a delay of at least 4 seconds between login prompts following a failed login attempt.

    &lt;VulnDiscussion&gt;Limiting the number of login attempts over a certain time interval reduces the chances that an unauthorized user may gain acc...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • AIX system must restrict the ability to switch to the root user to members of a defined group.

    &lt;VulnDiscussion&gt;Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing th...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • All AIX Group Identifiers (GIDs) referenced in the /etc/passwd file must be defined in the /etc/group file.

    &lt;VulnDiscussion&gt;If a user is assigned the GID of a group not existing on the system, and a group with that GID is subsequently created, the u...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • All AIX files and directories must have a valid owner.

    &lt;VulnDiscussion&gt;Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be ca...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX hosts.lpd file must not contain a + character.

    &lt;VulnDiscussion&gt;Having the '+' character in the hosts.lpd (or equivalent) file allows all hosts to use local system print resources.&lt;/Vuln...
    Rule Medium Severity
    Show

  • SRG-OS-000480-GPOS-00227

    <GroupDescription></GroupDescription>
    Group
    Show

  • The chargen daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;This service is used to test the integrity of TCP/IP packets arriving at the destination. This chargen service is a characte...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The discard daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The discard service is used as a debugging and measurement tool. It sets up a listening socket and ignores data that it recei...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The dtspc daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The dtspc service deals with the CDE interface of the X11 daemon. It is started automatically by the inetd daemon in response...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The pcnfsd daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The pcnfsd service is an authentication and printing program, which uses NFS to provide file transfer services. This service ...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The rstatd daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The rstatd service is used to provide kernel statistics and other monitorable parameters pertinent to the system such as: CPU...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The rusersd daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The rusersd service runs as root and provides a list of current users active on a system. An attacker may use this service to...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The AIX system must have no .netrc files on the system.

    &lt;VulnDiscussion&gt;Unencrypted passwords for remote FTP servers may be stored in .netrc files. Policy requires passwords be encrypted in storage...
    Rule High Severity
    Show

  • The klogin daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The klogin service offers a higher degree of security than traditional rlogin or telnet by eliminating most clear-text passwo...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The kshell daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The kshell service offers a higher degree of security than traditional rsh services. However, it still does not use encrypted...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The rquotad daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The rquotad service allows NFS clients to enforce disk quotas on file systems that are mounted on the local system. This serv...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The tftp daemon must be disabled on AIX.

    &lt;VulnDiscussion&gt;The tftp service allows remote systems to download or upload files to the tftp server without any authentication. It is there...
    Rule Medium Severity
    Show

  • SRG-OS-000095-GPOS-00049

    <GroupDescription></GroupDescription>
    Group
    Show

  • The imap2 service must be disabled on AIX.

    &lt;VulnDiscussion&gt;The imap2 service or Internet Message Access Protocol (IMAP) supports the IMAP4 remote mail access protocol. It works with se...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules