What changed in IBM AIX 7.x STIG V3R4V3R4 changes

Discussion

If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts are used, the operating system must be configured to automatically terminate these types of accounts after a DoDDoW-defined time period of 72 hours. To address access requirements, many operating systems may be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.

V-215170 in V3R4

Check text

If LDAP authentication is not used on AIX, this is Not Applicable. Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: gsk8capicmd (used below), gsk8capicmd_64 and gsk7cmd. Check if the system is using LDAP authentication: # grep LDAP /etc/security/user If no lines are returned, this requirement is not applicable. Check if the useSSL option is enabled: # grep '^useSSL' /etc/security/ldap/ldap.cfg useSSL:yes If "yes" is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server: # grep -i '^ldapsslkeyf' /etc/security/ldap/ldap.cfg ldapsslkeyf:/tmp/key.kdb If no line is found, this is a finding. Identify the Key Database (KDB), and its password, by asking the ISSO/SA. If no Key Database exists on the system, this is a finding. List the certificate issuer with GSK command: # gsk8capicmd -cert -list CA -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> Make note of the client Key Label: # gsk8capicmd -cert -details -showOID -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -label &ltKey Label> If the certificate is not issued by DoDDoW PKI or a DoDDoW-approved external PKI, this is a finding The IBM GSK Database should only have certificates for the client system and for the LDAP server. If more certificates are in the key database than the LDAP server and the client, this is a finding.

Fix text

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: gsk8capicmd (used below), gsk8capicmd_64 and gsk7cmd. Create a key database with DoDDoW PKI or DoDDoW-approved certificate using one of the following commands: # gsk8capicmd -keydb -create -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -type cms -stash Edit "/etc/security/ldap/ldap.cfg" and add or edit the "ldapsslkeyf" setting to reference a KDB file containing a client certificate issued by DoDDoW PKI or a DoDDoW-approved external PKI. Install a certificate signed by a DoDDoW PKI or a DoDDoW-approved external PKI using the following command: # gsk8capicmd -cert -add -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -file &ltCERT_FILE> -label &ltCERT_LABEL> Remove un-needed CA certificates using one of the following commands: # gsk8capicmd -cert -delete -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -label &ltCERT_LABEL> Restart LDAP client using command: # /usr/sbin/restart-secldapclntd

V-215173 in V3R4

Title

AIX must display the Standard Mandatory DoDW Notice and Consent Banner before granting local or remote login access to the system.

Check text

Check the herald is set to have the Standard Mandatory DoDDoW Notice and Consent Banner: # lssec -f /etc/security/login.cfg -s default -a herald The above command should display the herald setting like this: default herald="You are accessing a U.S. Government (USG) Information System (IS) that1n1ris provided for USG-authorized use only.1n1r1n1rBy using this IS (which includes any device attached to this IS), you1n1rconsent to the following conditions: 1n1r1n1r-The USG routinely intercepts and monitors communications on this IS1n1rfor purposes including, but not limited to, penetration testing, COMSEC1n1rmonitoring, network operations and defense, personnel misconduct (PM),1n1rlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1r1n1r-At any time, the USG may inspect and seize data stored on this IS. 1n1r1n1r-Communications using, or data stored on, this IS are not private, are1n1rsubject to routine monitoring, interception, and search, and may be1n1rdisclosed or used for any USG-authorized purpose. 1n1r1n1r-This IS includes security measures (e.g., authentication and access1n1rcontrols) to protect USG interests--not for your personal benefit or1n1rprivacy. 1n1r1n1r-Notwithstanding the above, using this IS does not constitute consent1n1rto PM, LE or CI investigative searching or monitoring of the content1n1rof privileged communications, or work product, related to personal1n1rrepresentation or services by attorneys, psychotherapists, or clergy,1n1rand their assistants. Such communications and work product are private1n1rand confidential. See User Agreement for details.1n1r1n1rlogin:" If the herald string is not set, or it does not contain the Standard Mandatory DoDDoW Notice and Consent Banner listed above, this is a finding.

Fix text

From the command prompt, run the following command to set the DoDDoW banner to herald for the default stanza in the "/etc/security/login.cfg" file: # chsec -f /etc/security/login.cfg -s default -a herald="You are accessing a U.S. Government (USG) Information System (IS) that1n1ris provided for USG-authorized use only.1n1r1n1rBy using this IS (which includes any device attached to this IS), you1n1rconsent to the following conditions: 1n1r1n1r-The USG routinely intercepts and monitors communications on this IS1n1rfor purposes including, but not limited to, penetration testing, COMSEC1n1rmonitoring, network operations and defense, personnel misconduct (PM),1n1rlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1r1n1r-At any time, the USG may inspect and seize data stored on this IS. 1n1r1n1r-Communications using, or data stored on, this IS are not private, are1n1rsubject to routine monitoring, interception, and search, and may be1n1rdisclosed or used for any USG-authorized purpose. 1n1r1n1r-This IS includes security measures (e.g., authentication and access1n1rcontrols) to protect USG interests--not for your personal benefit or1n1rprivacy. 1n1r1n1r-Notwithstanding the above, using this IS does not constitute consent1n1rto PM, LE or CI investigative searching or monitoring of the content1n1rof privileged communications, or work product, related to personal1n1rrepresentation or services by attorneys, psychotherapists, or clergy,1n1rand their assistants. Such communications and work product are private1n1rand confidential. See User Agreement for details.1n1r1n1rlogin:"

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-215200 in V3R4

Title

The Department ofW Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts on AIX.

Check text

If AIX CDE (X11) is not used, this is Not Applicable. Check if file "/etc/dt/config/en_US/Xresources" exists: # ls /etc/dt/config/en_US/Xresources If the file does not exist, this is a finding. Check if the "Dtlogin*greeting.labelString" is set to the Standard Mandatory DoDDoW Notice and Consent Banner: # grep "Dtlogin*greeting.labelString" /etc/dt/config/en_US/Xresources The above command should display the following: Dtlogin*greeting.labelString: You are accessing a U.S. Government (USG) Information System (IS) that1nis provided for USG-authorized use only.1n1nBy using this IS (which includes any device attached to this IS), you1nconsent to the following conditions: 1n1n-The USG routinely intercepts and monitors communications on this IS1nfor purposes including, but not limited to, penetration testing, COMSEC1nmonitoring, network operations and defense, personnel misconduct (PM),1nlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1n-At any time, the USG may inspect and seize data stored on this IS. 1n1n-Communications using, or data stored on, this IS are not private, are1nsubject to routine monitoring, interception, and search, and may be1ndisclosed or used for any USG-authorized purpose. 1n1n-This IS includes security measures (e.g., authentication and access1ncontrols) to protect USG interests--not for your personal benefit or1nprivacy. 1n1n-Notwithstanding the above, using this IS does not constitute consent1nto PM, LE or CI investigative searching or monitoring of the content1nof privileged communications, or work product, related to personal1nrepresentation or services by attorneys, psychotherapists, or clergy,1nand their assistants. Such communications and work product are private1nand confidential. See User Agreement for details. If the "Dtlogin*greeting.labelString" variable is not set, or the label string does not contain the Standard Mandatory DoDDoW Notice and Consent Banner, this is a finding.

Fix text

Edit the "Xresources" file to configure the system to display one of the DoDDoW login banners (based on the character limitations imposed by the system) prior to, or as part of, the graphical desktop environment login process. For "Dtlogin", change the variable "Dtlogin*greeting.labelString:" in "Xresources" file. # cp /usr/dt/config/C/Xresources /etc/dt/config/en_US/Xresources # vi /etc/dt/config/en_US/Xresources Set variable "Dtlogin*greeting.labelString" as the following: Dtlogin*greeting.labelString: You are accessing a U.S. Government (USG) Information System (IS) that1nis provided for USG-authorized use only.1n1nBy using this IS (which includes any device attached to this IS), you1nconsent to the following conditions: 1n1n-The USG routinely intercepts and monitors communications on this IS1nfor purposes including, but not limited to, penetration testing, COMSEC1nmonitoring, network operations and defense, personnel misconduct (PM),1nlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1n-At any time, the USG may inspect and seize data stored on this IS. 1n1n-Communications using, or data stored on, this IS are not private, are1nsubject to routine monitoring, interception, and search, and may be1ndisclosed or used for any USG-authorized purpose. 1n1n-This IS includes security measures (e.g., authentication and access1ncontrols) to protect USG interests--not for your personal benefit or1nprivacy. 1n1n-Notwithstanding the above, using this IS does not constitute consent1nto PM, LE or CI investigative searching or monitoring of the content1nof privileged communications, or work product, related to personal1nrepresentation or services by attorneys, psychotherapists, or clergy,1nand their assistants. Such communications and work product are private1nand confidential. See User Agreement for details. Save the above change to "Xresources" file.

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-215201 in V3R4

Title

The Department ofW Defense (DoD) login banner must be displayed during SSH, sftp, and scp login sessions on AIX.

Check text

Check if file "/etc/motd.ssh" exists: # ls /etc/motd.ssh If the file does not exist, this is a finding. Check if "/etc/motd.ssh" contains The Standard Mandatory DoDDoW Notice and Consent Banner: # cat /etc/motd.ssh The above command should display the following Standard Mandatory DoDDoW Notice and Consent Banner: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." If the Standard Mandatory DoDDoW Notice and Consent Banner is not displayed by the "cat" command, this is a finding. Check if /etc/motd.ssh is used as banner file in SSH config file: # grep -i "Banner /etc/motd.ssh" /etc/motd.ssh/sshd_config If the above grep command does not find "Banner /etc/motd.ssh" in the "/etc/motd.ssh/sshd_config" file, this is a finding.

Discussion

Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-215202 in V3R4

Title

Any publically accessible connection to AIX operating system must display the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the system.

Check text

Check the herald is set to have the Standard Mandatory DoDDoW Notice and Consent Banner: # lssec -f /etc/security/login.cfg -s default -a herald The above command should display the herald setting like this: default herald="You are accessing a U.S. Government (USG) Information System (IS) that1n1ris provided for USG-authorized use only.1n1r1n1rBy using this IS (which includes any device attached to this IS), you1n1rconsent to the following conditions: 1n1r1n1r-The USG routinely intercepts and monitors communications on this IS1n1rfor purposes including, but not limited to, penetration testing, COMSEC1n1rmonitoring, network operations and defense, personnel misconduct (PM),1n1rlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1r1n1r-At any time, the USG may inspect and seize data stored on this IS. 1n1r1n1r-Communications using, or data stored on, this IS are not private, are1n1rsubject to routine monitoring, interception, and search, and may be1n1rdisclosed or used for any USG-authorized purpose. 1n1r1n1r-This IS includes security measures (e.g., authentication and access1n1rcontrols) to protect USG interests--not for your personal benefit or1n1rprivacy. 1n1r1n1r-Notwithstanding the above, using this IS does not constitute consent1n1rto PM, LE or CI investigative searching or monitoring of the content1n1rof privileged communications, or work product, related to personal1n1rrepresentation or services by attorneys, psychotherapists, or clergy,1n1rand their assistants. Such communications and work product are private1n1rand confidential. See User Agreement for details.1n1r1n1rlogin:" If the herald string is not set, or it does not contain the Standard Mandatory DoDDoW Notice and Consent Banner listed above, this is a finding.

Fix text

From the command prompt, run the following command to set the DoDDoW banner to herald for the default stanza in /etc/security/login.cfg: # chsec -f /etc/security/login.cfg -s default -a herald="You are accessing a U.S. Government (USG) Information System (IS) that1n1ris provided for USG-authorized use only.1n1r1n1rBy using this IS (which includes any device attached to this IS), you1n1rconsent to the following conditions: 1n1r1n1r-The USG routinely intercepts and monitors communications on this IS1n1rfor purposes including, but not limited to, penetration testing, COMSEC1n1rmonitoring, network operations and defense, personnel misconduct (PM),1n1rlaw enforcement (LE), and counterintelligence (CI) investigations. 1n1r1n1r-At any time, the USG may inspect and seize data stored on this IS. 1n1r1n1r-Communications using, or data stored on, this IS are not private, are1n1rsubject to routine monitoring, interception, and search, and may be1n1rdisclosed or used for any USG-authorized purpose. 1n1r1n1r-This IS includes security measures (e.g., authentication and access1n1rcontrols) to protect USG interests--not for your personal benefit or1n1rprivacy. 1n1r1n1r-Notwithstanding the above, using this IS does not constitute consent1n1rto PM, LE or CI investigative searching or monitoring of the content1n1rof privileged communications, or work product, related to personal1n1rrepresentation or services by attorneys, psychotherapists, or clergy,1n1rand their assistants. Such communications and work product are private1n1rand confidential. See User Agreement for details.1n1r1n1rlogin:"

Discussion

Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-215203 in V3R4

Title

AIX must only allow the use of DoDW PKI-established certificate authorities for verification of the establishment of protected sessions.

Check text

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: gsk8capicmd (used below), gsk8capicmd_64 and gsk7cmd. Check if the system is using LDAP authentication: # grep LDAP /etc/security/user If no lines are returned, this requirement is not applicable. Check if the useSSL option is enabled: # grep '^useSSL' /etc/security/ldap/ldap.cfg useSSL:yes If "yes" is not the returned value, this is a finding. Verify a certificate is used for client authentication to the server: # grep -i '^ldapsslkeyf' /etc/security/ldap/ldap.cfg ldapsslkeyf:/tmp/key.kdb If no line is found, this is a finding. Identify the Key Database (KDB), and its password, by asking the ISSO/SA). If no Key Database exists on the system, this is a finding. List the certificate issuer with IBM GSK: # gsk8capicmd -cert -list CA -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> Make note of the client Key Label: # gsk8capicmd -cert -details -showOID -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -label &ltKey Label> If the certificate is not issued by DoDDoW PKI or a DoDDoW-approved external PKI, this is a finding. The IBM GSK Database should only have certificates for the client system and for the LDAP server. If more certificates are in the key database than the LDAP server and the client, this is a finding.

Fix text

Note: Depending on which version of GSKit is installed on AIX, the GSK commands that are used to manage the Key Database (KDB) have different names. The possible GSK commands are: gsk8capicmd (used below), gsk8capicmd_64 and gsk7cmd. Create a key database with DoDDoW PKI or DoDDoW-approved certificate using one of the following commands: # gsk8capicmd -keydb -create -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -type cms -stash Edit "/etc/security/ldap/ldap.cfg" and add or edit the "ldapsslkeyf" setting to reference a KDB file containing a client certificate issued by DoDDoW PKI or a DoDDoW-approved external PKI. Install a certificate signed by a DoDDoW PKI or a DoDDoW-approved external PKI using the following command: # gsk8capicmd -cert -add -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -file &ltCERT_FILE> -label &ltCERT_LABEL> Remove un-needed CA certificates using one of the following commands: # gsk8capicmd -cert -delete -db &ltKDB_FILE> -pw &ltKDB_PASSWORD> -label &ltCERT_LABEL> Restart LDAP client using command: # /usr/sbin/restart-secldapclntd

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoDDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoDDoW-approved CA, trust of this CA has not been established. The DoDDoW will only accept PKI-certificates obtained from a DoDDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates.

V-215215 in V3R4

Discussion

FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoDDoW requirements. This allows for Security Levels 1, 2, 3, or 4 for use on a general purpose computing system. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. AIX must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. OpenSSL FIPS object module is a cryptographic module that is designed to meet the requirements for FIPS 140-2 validation by CMVP and is compatible with OpenSSL libraries. The 2.0.13 FIPS object module version has been FIPS validated and certified by CMVP for multiple AIX versions on Power 7 and Power 8 platforms under certificate #2398. IBM has released a FIPS capable OpenSSL (Fileset VRMF: 20.13.102.1000), which is OpenSSL 1.0.2j version with 2.0.13 object module. The fileset is available in Web Download Pack. Satisfies: SRG-OS-000120-GPOS-00061, SRG-OS-000478-GPOS-00223, SRG-OS-000396-GPOS-00176

V-215216 in V3R4

Title

AIX Operating systems must enforce a 6180-day maximum password lifetime restriction.

Check text

From the command prompt, run the following command to check the system default "maxage" attribute value: # lssec -f /etc/security/user -s default -a maxage default maxage=825 If the default "maxage" value is not set, or its value is great than "825", or its value is set to "0", this is a finding. From the command prompt, run the following command to check "maxage" attribute value for all accounts: # lsuser -a maxage ALL root maxage=825 user1 maxage=825 user2 maxage=825 If any user does not have "maxage" set, or its "maxage" value is greater than "825", or its value is set to "0", this is a finding.

Fix text

From the command prompt, run the following command to set "maxage=825" (56175 days) for the default stanza in "/etc/security/user": # chsec -f /etc/security/user -s default -a maxage=825 For each user who has "maxage" value great than "825", set its "maxage" to "825" by running the following command from command prompt: # chsec -f /etc/security/user -s [user_name] -a maxage=825

V-215223 in V3R4

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoDDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Operating system functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-215233 in V3R4

Discussion

The ability to specify the event criteria that are of interest provides the individuals reviewing the logs with the ability to quickly isolate and identify these events without having to review entries that are of little or no consequence to the investigation. Without this capability, forensic investigations are impeded. Events of interest can be identified by the content of specific audit record fields, including, for example, identities of individuals, event types, event locations, event times, event dates, system resources involved, IP addresses involved, or information objects accessed. Organizations may define audit event criteria to any degree of granularity required, for example, locations selectable by general networking location (e.g., by network or subnetwork) or selectable by specific information system component. The ability to generate on-demand reports, including after the audit data has been subjected to audit reduction, greatly facilitates the organization's ability to generate incident reports as needed to better handle larger-scale or more complex security incidents. The ability to perform on-demand audit review and analysis, including after the audit data has been subjected to audit reduction, greatly facilitates the organization's ability to generate incident reports, as needed, to better handle larger-scale or more complex security incidents. If the audit reduction capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack, or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. Audit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. The report generation capability provided by the application must support on-demand (i.e., customizable, ad hoc, and as-needed) reports. This requires operating systems to provide the capability to customize audit record reports based on all available criteria. Satisfies: SRG-OS-000054-GPOS-00025, SRG-OS-000122-GPOS-00063, SRG-OS-000348-GPOS-00136, SRG-OS-000349-GPOS-00137

V-215242 in V3R4

Title

AIX must provide audit record generation functionality for DoDW-defined auditable events.

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the information system (e.g., module or policy filter). The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which AIX will provide an audit record generation capability as the following: 1) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); 2) Access actions, such as successful and unsuccessful login attempts, privileged activities or other system-level access, starting and ending time for user access to the system, concurrent logins from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; 3) All account creations, modifications, disabling, and terminations; and 4) All kernel module load, unload, and restart actions. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000004-GPOS-00004, SRG-OS-000051-GPOS-00024, SRG-OS-000064-GPOS-00033, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000277-GPOS-00107, SRG-OS-000303-GPOS-00120, SRG-OS-000304-GPOS-00121, SRG-OS-000327-GPOS-00127, SRG-OS-000327-GPOS-00127, SRG-OS-000364-GPOS-00151, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000468-GPOS-00212, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222

V-215246 in V3R4

Discussion

The report generation capability must support on-demand review and analysis in order to facilitate the organization's ability to generate incident reports, as needed, to better handle larger-scale or more complex security incidents. If the report generation capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack, or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. Report generation must be capable of generating on-demand (i.e., customizable, ad hoc, and as-needed) reports. On-demand reporting allows personnel to report issues more rapidly to more effectively meet reporting requirements. Collecting log data and aggregating it to present the data in a single, consolidated report achieves this objective. Satisfies: SRG-OS-000350-GPOS-00138, SRG-OS-000351-GPOS-00139, SRG-OS-000352-GPOS-00140

V-215254 in V3R4

Discussion

Rotate audit logs daily to preserve audit file system space and to conform to the DoDDoW/DISA requirement. If it is not rotated daily and moved to another location, then there is more of a chance for the compromise of audit data by malicious users.

V-215256 in V3R4

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoDDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-215285 in V3R4

Discussion

Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoDDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyberattacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).

V-215286 in V3R4

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoDDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.

V-215289 in V3R4

Discussion

DoDW information systems are required to use FIPS 140-2 approved cryptographic hash functions.

V-215294 in V3R4

Check text

If NFS is a mission requirement and is documented with the information system security officer (ISSO), this requirement is not applicable. From the command prompt, execute the following command: # lsitab rcnfs If the command yields any output, this is a finding.

V-215352 in V3R4

Check text

From the command prompt, execute the following command: # grep "^#cmsd[[:blank:]]" /etc/inetd.conf If there is any output from the command, this is a finding.

Fix text

In "/etc/inetd.conf", comment out the "cmsd" entry by running command: # chsubserver -r inetd -C /etc/inetd.conf -d -v 'cmsd' -p 'sunrpc_udpudp' Restart inetd: # refresh -s inetd

V-215370 in V3R4

Check text

From the command prompt, execute the following command: # grep "^#ttdbserver[[:blank:]]" /etc/inetd.conf If there is any output from the command, this is a finding.

Fix text

In "/etc/inetd.conf", comment out the "ttdbserver" entry by running command: # chsubserver -r inetd -C /etc/inetd.conf -d -v 'ttdbserver' -p 'sunrpc_tcptcp' Restart inetd: # refresh -s inetd

V-215371 in V3R4

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoDDoW nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of a mechanism is selected based on the security categorization of the information.

V-215402 in V3R4

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoDDoW-approved PKIs, all DoDDoW systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. Security functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Operating systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk and address space protections that protect executing code. Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ownership is usually acquired as a consequence of creating the object or via specified ownership assignment. DAC allows the owner to determine who will have access to objects they control. An example of DAC includes user-controlled file permissions. Operating system functionality will vary, and while users are not permitted to install unapproved software, there may be instances where the organization allows the user to install approved software packages, such as from an approved software repository. AIX or software configuration management utility must enforce control of software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000134-GPOS-00068, SRG-OS-000312-GPOS-00123, SRG-OS-000362-GPOS-00149

V-215404 in V3R4

Discussion

To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: 1. Something you know (e.g., password/PIN); 2. Something you have (e.g., cryptographic identification device, token); and 3. Something you are (e.g., biometric). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication. Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055, SRG-OS-000375-GPOS-00160

V-215436 in V3R4

Discussion

To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: 1. Something you know (e.g., password/PIN); 2. Something you have (e.g., cryptographic identification device, token); and 3. Something you are (e.g., biometric). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-215437 in V3R4

Discussion

To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: 1. Something you know (e.g., password/PIN); 2. Something you have (e.g., cryptographic identification device, token); and 3. Something you are (e.g., biometric). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-215438 in V3R4

Discussion

To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: 1. Something you know (e.g., password/PIN); 2. Something you have (e.g., cryptographic identification device, token); and 3. Something you are (e.g., biometric). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-215439 in V3R4

Discussion

To assure accountability and prevent unauthenticated access, privileged and non-privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: 1. Something you know (e.g., password/PIN); 2. Something you have (e.g., cryptographic identification device, token); and 3. Something you are (e.g., biometric). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-215440 in V3R4

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12, as well as making the CAC a primary component of layered protection for national security systems. Satisfies: SRG-OS-000376-GPOS-00161, SRG-OS-000377-GPOS-00162

V-215441 in V3R4

Discussion

Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DoDDoW data.

V-219057 in V3R4