Ensure autoconf6 is not in use

MediumLevel 1Automatedaix

Description

This entry starts autoconf6 on system startup. This is to automatically configure IPv6 interfaces at boot time. autoconf6 is used to automatically configure IPv6 interfaces at boot time. Running this service may allow other hosts on the same physical subnet to connect via IPv6, even when the network does not support it. Audit: the autoconf6 start line in /etc/rc.tcpip must be commented out and the autoconf6 subsystem must not be active.

How it is checked

Audit method: Shell command

shell

command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/autoconf6([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s autoconf6 | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

In /etc/rc.tcpip, comment out the autoconf6 entry: chrctcp -d autoconf6

Properties

Operating systems: Any
Tags: aixhardening
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.3.1 Ensure autoconf6 is not in use

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix