IBM AIX 7.x Security Technical Implementation Guide

The IBM AIX 7.x Security Technical Implementation Guide (V3 R4) has 282 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

282STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

The regular users default primary group must be staff (or equivalent) on AIX.

IBM AIX 7.x Security Technical Implementation Guide

Assessment Title

Rule Text

The regular users default primary group must be staff (or equivalent) on AIX.

Description

Discussion Text

The /usr/lib/security/mkuser.default file contains the default primary groups for regular and admin users. Setting a system group as the regular users' primary group increases the risk that the regular users can access privileged resources.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215182

Rule

SV-215182r958362_rule

Severity

medium

Rule Version

AIX7-00-001016

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check the default primary group for regular users:
# lssec -f /etc/security/mkuser.default -s user -a pgrp

The above command should yield the following output:
user pgrp=staff

If the above command shows that the primary group (pgrp) is not "staff", this is a finding.

Implementation Procedure

Fix Text

Set the default primary groups for regular to be "staff".
# chsec -f /etc/security/mkuser.default -s user -a pgrp=staff

STIG check 14 of 282 in the IBM AIX 7.x STIG checklist

← Previous · V-215181The shipped /etc/security/mkuser.sys file on AIX must not be customized directly.Next · V-215183 →All system files, programs, and directories must be owned by a system account.