Skip to content

The shipped /etc/security/mkuser.sys file on AIX must not be customized directly.

An XCCDF Rule

Description

The "/etc/security/mkuser.sys" script customizes the new user account when a new user is created, or a user is logging into the system without a home directory. An improper "/etc/security/mkuser.sys" script increases the risk that non-privileged users may obtain elevated privileges.

ID
SV-215181r958362_rule
Version
AIX7-00-001015
Severity
Medium
References
Updated

Remediation Templates

A Manual Procedure

Edit the script /etc/security/mkuser.sys to contain the following:
#   This file is no longer user customizable.  To have a customized mkuser.sys script
#   create a file /etc/security/mkuser.sys.custom and the /etc/security/mkuser.sys
#   will run this script instead of the original mkuser.sys script.

export PATH=/usr/bin:/usr/sbin:$PATH