IBM AIX 7.x Security Technical Implementation Guide

The IBM AIX 7.x Security Technical Implementation Guide (V3 R4) has 282 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

282STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

The AIX SSH daemon must be configured to disable user .rhosts files.

IBM AIX 7.x Security Technical Implementation Guide

Assessment Title

Rule Text

The AIX SSH daemon must be configured to disable user .rhosts files.

Description

Discussion Text

Trust .rhost file means a compromise on one host can allow an attacker to move trivially to other hosts.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215303

Rule

SV-215303r991591_rule

Severity

medium

Rule Version

AIX7-00-002121

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Check the SSH daemon configuration for allowed ".rhosts" using command: 

# grep -i IgnoreRhosts /etc/ssh/sshd_config | grep -v '^#' 
IgnoreRhosts yes

If no lines are returned, or the returned "IgnoreRhosts" directive is not set to "yes", this is a finding.

Implementation Procedure

Fix Text

Edit "/etc/ssh/sshd_config" and add or update the "IgnoreRhosts " line as:
IgnoreRhosts  yes

Save the change and restart ssh daemon:
# stopsrc -s sshd
# startsrc -s sshd

STIG check 132 of 282 in the IBM AIX 7.x STIG checklist

← Previous · V-215302The AIX SSH daemon must be configured to disable empty passwords.Next · V-215304 →The AIX SSH daemon must be configured to not use host-based authentication.