II - Mission Support Public
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000368-GPOS-00154
<GroupDescription></GroupDescription>Group -
AIX must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.
<VulnDiscussion>Control of program execution is a mechanism used to prevent execution of unauthorized programs. Some operating systems may pr...Rule Medium Severity -
SRG-OS-000437-GPOS-00194
<GroupDescription></GroupDescription>Group -
AIX must remove all software components after updated versions have been installed.
<VulnDiscussion>Previous versions of software components that are not removed from the information system after updates have been installed m...Rule Medium Severity -
SRG-OS-000480-GPOS-00226
<GroupDescription></GroupDescription>Group -
AIX must enforce a delay of at least 4 seconds between login prompts following a failed login attempt.
<VulnDiscussion>Limiting the number of login attempts over a certain time interval reduces the chances that an unauthorized user may gain acc...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
AIX system must restrict the ability to switch to the root user to members of a defined group.
<VulnDiscussion>Configuring a supplemental group for users permitted to switch to the root user prevents unauthorized users from accessing th...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
All AIX Group Identifiers (GIDs) referenced in the /etc/passwd file must be defined in the /etc/group file.
<VulnDiscussion>If a user is assigned the GID of a group not existing on the system, and a group with that GID is subsequently created, the u...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
All AIX files and directories must have a valid owner.
<VulnDiscussion>Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be ca...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The sticky bit must be set on all public directories on AIX systems.
<VulnDiscussion>Failing to set the sticky bit on public directories allows unauthorized users to delete files in the directory structure. The...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The AIX global initialization files must contain the mesg -n or mesg n commands.
<VulnDiscussion>Command "mesg -n" allows only the root user the permission to send messages to your workstation to avoid having others clutte...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
The AIX hosts.lpd file must not contain a + character.
<VulnDiscussion>Having the '+' character in the hosts.lpd (or equivalent) file allows all hosts to use local system print resources.</Vuln...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
<GroupDescription></GroupDescription>Group -
AIX sendmail logging must not be set to less than nine in the sendmail.cf file.
<VulnDiscussion>If Sendmail is not configured to log at level 9, system logs may not contain the information necessary for tracking unauthori...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.