TMA-SOLARIS-2.7
Disable Kerberos TGT Expiration Warning
LowLevel 1Automatedsolaris
Description
The Kerberos TGT warning service is used to warn users when their Kerberos tickets are about to expire or to renew those tickets before they expire. This service is not used if Kerberos has not been configured. This service is configured to be "local only" by default. This service should be disabled if it is not required. Audit: `svcs -Ho state` must report disabled or uninitialized; a service that is not installed is compliant.
How it is checked
Audit method: Shell command
shell
command -v svcs >/dev/null 2>&1 || exit 1; r=compliant; for f in svc:/network/security/ktkt_warn; do st=$(svcs -Ho state "$f" 2>/dev/null); case "$st" in ''|disabled|uninitialized) ;; *) r="$f: $st";; esac; done; echo "$r"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
svcadm disable svc:/network/security/ktkt_warn
Properties
- Operating systems
- Any
- Tags
- solarishardening
- Reference
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 2.7 Disable Kerberos TGT Expiration Warning
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target solaris