IBM AIX
TMA-AIX-4.3.2.1
Ensure inetd daemon is disabled when no additional services are required
Description
When none of the services run and managed by inetd are required then disable the inetd daemon itself. This is the preferred state. When no inetd managed services are required there is no need to start the daemon at boot time. An administrator can manually start the inetd service post-IPL, should any of the inetd supported services are/become required. Audit: the inetd start line in /etc/rc.tcpip must be commented out and the inetd subsystem must not be active.
How it is checked
Audit method: Shell command
command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/inetd([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s inetd | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Review any active inetd services: refresh -s inetd lssrc -ls inetd NOTE: If there are active services and the services are required, do not disable inetd. Skip to the next section and consider the implementation of TCP Wrappers to secure access to these active services. If the active services are not required disable them via the chsubserver command. Disable inetd if there are no active services: chrctcp -d inetd stopsrc -s inetd
Properties
- Operating systems
- Any
- Tags
- aixservices
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.1 Ensure inetd daemon is disabled when no additional services are required
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix