TMA-AIX-2.6
Ensure regular scans for unauthorized applications
Açıklama
This recommendation is find and report (audit) software on the system that has not been included in the TE (trusted execution) TSD (trusted signature database). These entries establish a so-called AllowList. Software not included on this AllowList should be generating a syslog and/or audit record whenever it is executed.
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
The following command will locate the software AIX considers untrusted aka TROJAN. Note: the output goes to stderr so stderr is first joined to stdout and thereafter stdout get redirected to /dev/null. The argument -i instructs the scan to ignore NFS mounts. trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
This will be a manual process. The remediation is to find and remove the offending file (currently the reported file might be the artifact of another error - most common is a symbolic link that points at a non-existent object). The starting point is running the same command from the AUDIT section: trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted Line by line, verify the root cause and act (one of): remove the offending object remove SUID/SGID settings remove privcmds setting add to TSD aka AllowList
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- aixhardening
- Referans
- CIS IBM AIX 7 Benchmark v1.2.0 - 2.6 Ensure regular scans for unauthorized applications