TMA-AIX-4.1.2.5

Ensure access to /etc/security is configured

中レベル 1自動aix

説明

The /etc/security directory contains multiple files and directories used to keep the targeted AIX system secure. Most subsystems are owned by root:security (UID:GID). However, additional systems such as AUDIT and AIXPERT have their own permissions (and recommendations). Traditionally, /etc/security has been identified as USER administration - including the shadow password file. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

チェック方法

監査方法: シェルコマンド

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type d | egrep -v "security/(aixpert|audit|ice)" | sort | xargs ls -led | awk '{print $1 " " $3 " " $4 " " $9}' | egrep -v "dr[w-]x[r-]-[sS-]----" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Ensure correct access control settings for security subsystem configuration files installed in /etc/security: #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022, 2025 EXCLUDE="security/(aixpert|audit|ice)" find /etc/security -type d | \ /usr/bin/egrep -v ${EXCLUDE} | \ /usr/bin/sort | xargs ls -led | \ /usr/bin/awk '{print $1 " " $3 " " $4 " " $9}' | \ /usr/bin/grep -v drwxr-s---- | \ awk '{print $NF}' | while read SECDIR; do /usr/bin/find ${SECDIR} | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chown root:security /usr/bin/find ${SECDIR} -type d | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod g-w+s,o-rwx /usr/bin/find ${SECDIR} -type f | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod u-x,g-wx,o-rwx done

プロパティ

オペレーティングシステム: すべて
タグ: aixpermissions
参照: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.5 Ensure access to /etc/security is configured

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target aix