AIX must be configured to only boot from the system boot device.
An XCCDF Rule
Description
The ability to boot from removable media is the same as being able to boot into single user or maintenance mode without a password. This ability could allow a malicious user to boot the system and perform changes possibly compromising or damaging the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.
- ID
- SV-215410r991589_rule
- Version
- AIX7-00-003112
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the system to only boot from system startup media:
# bootlist -m normal hdisk<x>
Set "multi-boot" to "off" in the SMS application.