AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

The AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE (V1 R14) has 506 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

506STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R14

CurrentPublished Fri Oct 26 2018

The system's access control program must be configured to grant or deny system access to specific hosts.

AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE

Assessment Title

Rule Text

The system's access control program must be configured to grant or deny system access to specific hosts.

Description

Discussion Text

If the system's access control program is not configured with appropriate rules for allowing and denying access to system network resources, services may be accessible to unauthorized hosts.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-12030

Rule

SV-41532r1_rule

Severity

medium

Rule Version

GEN006620

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check for the existence of the /etc/hosts.allow and /etc/hosts.deny files.

Procedure:
# ls -la /etc/hosts.allow
# ls -la /etc/hosts.deny

If either file does not exist, this is a finding.

Check for the presence of a default deny entry.

Procedure:
# grep "ALL: ALL" /etc/hosts.deny

If the "ALL: ALL" entry is not present in the /etc/hosts.deny file, any TCP service from a host or network not matching other rules will be allowed access.  If the entry is not in /etc/hosts.deny, this is a finding.

Implementation Procedure

Fix Text

Edit the /etc/hosts.allow and /etc/hosts.deny files to configure access restrictions.

STIG check 65 of 506 in the AIX 6.1 STIG checklist

← Previous · V-12028The system vulnerability assessment tool, host-based intrusion detection tool, and file integrity tool must notify the SA and the IAO of a security breach or a suspected security breach.Next · V-12035 →The SYSTEM attribute must not be set to NONE for any account.