Direct logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.
An XCCDF Rule
Description
<VulnDiscussion>Shared accounts (accounts where two or more people log in with the same user identification) do not provide identification and authentication. There is no way to provide for non-repudiation or individual accountability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-215178r508663_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Direct login to shared or application accounts can be prevented by setting the "rlogin=false" in the accounts stanza of the "/etc/security/user" file.
From the command prompt, run the following command to set "rlogin=false" for a shared account:
# chuser rlogin=false [shared_account]