Ensure NIS server services are not in use

How it is checked

Audit method: Shell command

command -v lslpp >/dev/null 2>&1 || exit 1; lslpp -L >/dev/null 2>&1 || exit 1; out=$( { lslpp -L | grep -i 'bos.net.nis.server' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Ensure that all of the NIS daemons are inactive: stopsrc -g yp De-install the NIS server software: installp -u bos.net.nis.server - OR - - IF - the NIS server package is required as a dependency, or NIS must be used in the environment, and is approved by local site policy: Ensure that all of the NIS daemons are inactive: stopsrc -g yp De-install the NIS server software: installp -u bos.net.nis.server Create and secure the /var/yp/securenets file (if it does not already exist): touch /var/yp/securenets chmod u=rw,go= /var/yp/securenets chown root:system /var/yp/securenets Edit the file: vi /var/yp/securenets Add the allowed subnets: 255.255.255.0 128.311.10.0 NOTE: The format of the file is netmask netaddr as shown in the example above. Explicitly define all valid network subnets (one entry per line). Stop and start NIS to implement the configuration changes: stopsrc -g yp startsrc -g yp

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target aix