IBM AIX 7.x Security Technical Implementation Guide

The IBM AIX 7.x Security Technical Implementation Guide (V3 R4) has 282 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

282STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V3 · R4

CurrentPublished Wed Sep 30 2026

If AIX SSH daemon is required, the SSH daemon must only listen on the approved listening IP addresses.

IBM AIX 7.x Security Technical Implementation Guide

Assessment Title

Rule Text

If AIX SSH daemon is required, the SSH daemon must only listen on the approved listening IP addresses.

Description

Discussion Text

The SSH daemon should only listen on the approved listening IP addresses. Otherwise the SSH service could be subject to unauthorized access.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-215306

Rule

SV-215306r991593_rule

Severity

medium

Rule Version

AIX7-00-002124

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the command prompt, run the following command to check if "ListenAddress" is defined in SSH config file:

# grep -i ListenAddress /etc/ssh/sshd_config | grep -v '^#'
ListenAddress  10.17.76.74

If no configuration is returned, or if a returned listen configuration contains addresses not permitted, this is a finding.

Implementation Procedure

Fix Text

Edit the SSH daemon config file and add/modify the "ListenAddress" network addresses:
# vi /etc/ssh/sshd_config

Restart SSH daemon:
# stopsrc -s sshd
# startsrc -s sshd

STIG check 135 of 282 in the IBM AIX 7.x STIG checklist

← Previous · V-215305The AIX SSH daemon must not allow RhostsRSAAuthentication.Next · V-215308 →AIX system must require authentication upon booting into single-user and maintenance modes.