Ensure inetd daemon is disabled when no additional services are required

СреднийУровень 1Автоматическаяaix

Описание

When none of the services run and managed by inetd are required then disable the inetd daemon itself. This is the preferred state. When no inetd managed services are required there is no need to start the daemon at boot time. An administrator can manually start the inetd service post-IPL, should any of the inetd supported services are/become required. Audit: the inetd start line in /etc/rc.tcpip must be commented out and the inetd subsystem must not be active.

Как проверяется

Метод проверки: Команда оболочки

shell

command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/inetd([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s inetd | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Review any active inetd services: refresh -s inetd lssrc -ls inetd NOTE: If there are active services and the services are required, do not disable inetd. Skip to the next section and consider the implementation of TCP Wrappers to secure access to these active services. If the active services are not required disable them via the chsubserver command. Disable inetd if there are no active services: chrctcp -d inetd stopsrc -s inetd

Свойства

Операционные системы: Любая
Теги: aixservices
Источник: CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.1 Ensure inetd daemon is disabled when no additional services are required

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target aix