IBM AIX
TMA-AIX-4.3.3.3
Ensure ndpd-router is not in use
Description
This entry starts ndpd-router on system startup. This manages the Neighbor Discovery Protocol (NDP) for non kernel activities. It receives Router Solicitations and sends Router Advertisements. It can also exchange routing information using the RIPng protocol. The ndpd-router manages NDP for non-kernel activities. Unless the server utilizes IPv6, this is not required and should be disabled. Audit: the ndpd-router start line in /etc/rc.tcpip must be commented out and the ndpd-router subsystem must not be active.
How it is checked
Audit method: Shell command
command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/ndpd-router([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s ndpd-router | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
In /etc/rc.tcpip, comment out the ndpd-router entry: chrctcp -d ndpd-router
Properties
- Operating systems
- Any
- Tags
- aixnetwork
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.3.3 Ensure ndpd-router is not in use
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix