TMA-AIX-4.1.2.5

Ensure access to /etc/security is configured

보통레벨 1자동aix

설명

The /etc/security directory contains multiple files and directories used to keep the targeted AIX system secure. Most subsystems are owned by root:security (UID:GID). However, additional systems such as AUDIT and AIXPERT have their own permissions (and recommendations). Traditionally, /etc/security has been identified as USER administration - including the shadow password file. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

점검 방법

감사 방식: 셸 명령

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type d | egrep -v "security/(aixpert|audit|ice)" | sort | xargs ls -led | awk '{print $1 " " $3 " " $4 " " $9}' | egrep -v "dr[w-]x[r-]-[sS-]----" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Ensure correct access control settings for security subsystem configuration files installed in /etc/security: #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022, 2025 EXCLUDE="security/(aixpert|audit|ice)" find /etc/security -type d | \ /usr/bin/egrep -v ${EXCLUDE} | \ /usr/bin/sort | xargs ls -led | \ /usr/bin/awk '{print $1 " " $3 " " $4 " " $9}' | \ /usr/bin/grep -v drwxr-s---- | \ awk '{print $NF}' | while read SECDIR; do /usr/bin/find ${SECDIR} | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chown root:security /usr/bin/find ${SECDIR} -type d | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod g-w+s,o-rwx /usr/bin/find ${SECDIR} -type f | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod u-x,g-wx,o-rwx done

속성

운영 체제: 모두
태그: aixpermissions
참고 자료: CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.5 Ensure access to /etc/security is configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aix