TMA-AIX-4.3.1.7
Ensure NIM master is not installed
MediumLevel 1Automatedaix
Description
The NIM master provides services to support network based installation, patching and automation against managed AIX client systems. The fileset bos.sysmgt.nim.master is not installed by default IBM installation processes. Only system(s) specifically designated and additionally hardened to safely perform the service NIM master should have this fileset installed. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
shell
command -v lslpp >/dev/null 2>&1 || exit 1; out=$( { lslpp -Lc bos.sysmgt.nim.master bos.sysmgt.nim.spot 2>/dev/null | grep sysmgt.nim ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Remove the software installp -u bos.sysmgt.nim.master bos.sysmgt.nim.spot
Properties
- Operating systems
- Any
- Tags
- aixservices
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.1.7 Ensure NIM master is not installed
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target aix