IBM AIX 7.x Security Technical Implementation Guide

The IBM AIX 7.x Security Technical Implementation Guide (V3 R4) has 282 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

282STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

On AIX, the SSH server must not permit root logins using remote access programs.

IBM AIX 7.x Security Technical Implementation Guide

Assessment Title

Rule Text

On AIX, the SSH server must not permit root logins using remote access programs.

Description

Discussion Text

Permitting direct root login reduces auditable information about who ran privileged commands on the system and also allows direct attack attempts on root's password.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215287

Rule

SV-215287r1268251_rule

Severity

medium

Rule Version

AIX7-00-002102

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Determine if the SSH daemon is configured to disable root logins:
# grep -iE "PermitRootLogin[[:blank:]]*no" /etc/ssh/sshd_config | grep -v \#

If the above command displays a line, the root login is disabled.

If the root login is not disabled, this is a finding.

Implementation Procedure

Fix Text

Edit the "/etc/ssh/sshd_config" file to have the following line and save the change: 
PermitRootLogin no

Restart SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd

STIG check 116 of 282 in the IBM AIX 7.x STIG checklist

← Previous · V-215286AIX must monitor and record unsuccessful remote logins.Next · V-215288 →All AIX shells referenced in passwd file must be listed in /etc/shells file, except any shells specified for the purpose of preventing logins.