Ensure dtlogin service is not available

MediumLevel 1Automatedaix

Description

Do not start CDE automatically on system boot. As the benchmark is intended for use on logical partitions which will not have a graphical console, CDE should not be started automatically to reduce the attack surface of the system. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

How it is checked

Audit method: Shell command

shell

command -v lsitab >/dev/null 2>&1 || exit 1; out=$( { lsitab dt; lsitab dt_nogb ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Disable CDE start up: /usr/dt/bin/dtconfig -d End any current instances: /usr/dt/bin/dtconfig -kill NOTE: If CDE is not installed the command will not be found

Properties

Operating systems: Any
Tags: aixaccounts
Reference: CIS IBM AIX 7 Benchmark v1.2.0 - 4.6.1.3 Ensure dtlogin service is not available

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target aix