TMA-AIX-4.3.2.10
Ensure routed is not in use
Deskripsi
The routed daemon manages the network routing tables in the kernel. The routed daemon should not be used as it only supports RIP1, it is recommended that the routed daemon is disabled to reduce the potential attack surface. Audit: the routed start line in /etc/rc.tcpip must be commented out and the routed subsystem must not be active.
Cara pemeriksaan
Metode audit: Perintah shell
command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/routed([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s routed | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Output yang diharapkan
compliant
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Run the following script to stop and disable routed #!/usr/bin/ksh DAEMONS="routed" for l_daemon in $DAEMONS; do /usr/sbin/chrctcp -d $l_daemon /usr/bin/stopsrc -s $l_daemon done NOTE: routed is provided by bos.net.tcp.server_core so it is not possible to remove this fileset.
Properti
- Sistem operasi
- Apa saja
- Tag
- aixnetwork
- Referensi
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.10 Ensure routed is not in use
Periksa host ini
Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.
tmaegis scan --target aix