TMA-AIX-2.6
Ensure regular scans for unauthorized applications
説明
This recommendation is find and report (audit) software on the system that has not been included in the TE (trusted execution) TSD (trusted signature database). These entries establish a so-called AllowList. Software not included on this AllowList should be generating a syslog and/or audit record whenever it is executed.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
The following command will locate the software AIX considers untrusted aka TROJAN. Note: the output goes to stderr so stderr is first joined to stdout and thereafter stdout get redirected to /dev/null. The argument -i instructs the scan to ignore NFS mounts. trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted
修正方法
修正方法: ガイダンスまたは IaC パッチ
This will be a manual process. The remediation is to find and remove the offending file (currently the reported file might be the artifact of another error - most common is a symbolic link that points at a non-existent object). The starting point is running the same command from the AUDIT section: trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted Line by line, verify the root cause and act (one of): remove the offending object remove SUID/SGID settings remove privcmds setting add to TSD aka AllowList
プロパティ
- オペレーティングシステム
- すべて
- タグ
- aixhardening
- 参照
- CIS IBM AIX 7 Benchmark v1.2.0 - 2.6 Ensure regular scans for unauthorized applications