Oracle Solaris
TMA-SOLARIS-6.1
Disable login: Services on Serial Ports
MediumLevel 1Automatedsolaris
Description
The svccfg command provides service administration for the lower level of the Service Access Facility hierarchy and can be used to disable the ability to login on a particular port. Login services should not be enabled on any serial ports that are not strictly required to support the mission of the system. This action can be safely performed even when console access is provided using a serial port. Audit: `svcs -Ho state` must report disabled; a service that is not installed is compliant.
How it is checked
Audit method: Shell command
shell
command -v svcs >/dev/null 2>&1 || exit 1; r=compliant; for f in svc:/system/console-login:terma svc:/system/console-login:termb; do st=$(svcs -Ho state "$f" 2>/dev/null); case "$st" in ''|disabled) ;; *) r="$f: $st";; esac; done; echo "$r"- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
svcadm disable svc:/system/console-login:terma svc:/system/console-login:termb
Properties
- Operating systems
- Any
- Tags
- solarisaccounts
- Reference
- CIS Oracle Solaris 11.4 Benchmark v1.1.0 - 6.1 Disable login: Services on Serial Ports
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target solaris