IBM AIX 7.x Security Technical Implementation Guide

The IBM AIX 7.x Security Technical Implementation Guide (V3 R4) has 282 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

282STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

AIX default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.

IBM AIX 7.x Security Technical Implementation Guide

Assessment Title

Rule Text

AIX default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.

Description

Discussion Text

To centralize the management of privileged account crontabs, of the default system accounts, only root may have a crontab.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215192

Rule

SV-215192r1268251_rule

Severity

medium

Rule Version

AIX7-00-001033

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check the "cron.allow" and "cron.deny" files for the system using commands:
# more /var/adm/cron/cron.allow 
# more /var/adm/cron/cron.deny 

If the "cron.allow" file exists and is empty, this is a finding.

If a default system account (such as bin, sys, adm, or lpd) is listed in the "cron.allow" file, or not listed in the "cron.deny" file, this is a finding.

Implementation Procedure

Fix Text

Remove default system accounts (such as bin, sys, adm, or lpd) from the "cron.allow" file, or add those accounts to the "cron.deny" file.

STIG check 23 of 282 in the IBM AIX 7.x STIG checklist

← Previous · V-215191AIX administrative accounts must not run a web browser, except as needed for local service administration.Next · V-215193 →The AIX root account must not have world-writable directories in its executable search path.