IBM AIX
TMA-AIX-4.1.2.5
Ensure access to /etc/security is configured
Mô tả
The /etc/security directory contains multiple files and directories used to keep the targeted AIX system secure. Most subsystems are owned by root:security (UID:GID). However, additional systems such as AUDIT and AIXPERT have their own permissions (and recommendations). Traditionally, /etc/security has been identified as USER administration - including the shadow password file. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type d | egrep -v "security/(aixpert|audit|ice)" | sort | xargs ls -led | awk '{print $1 " " $3 " " $4 " " $9}' | egrep -v "dr[w-]x[r-]-[sS-]----" ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Ensure correct access control settings for security subsystem configuration files installed in /etc/security: #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022, 2025 EXCLUDE="security/(aixpert|audit|ice)" find /etc/security -type d | \ /usr/bin/egrep -v ${EXCLUDE} | \ /usr/bin/sort | xargs ls -led | \ /usr/bin/awk '{print $1 " " $3 " " $4 " " $9}' | \ /usr/bin/grep -v drwxr-s---- | \ awk '{print $NF}' | while read SECDIR; do /usr/bin/find ${SECDIR} | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chown root:security /usr/bin/find ${SECDIR} -type d | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod g-w+s,o-rwx /usr/bin/find ${SECDIR} -type f | /usr/bin/grep -v ${EXCLUDE} | /usr/bin/xargs chmod u-x,g-wx,o-rwx done
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- aixpermissions
- Tham chiếu
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.5 Ensure access to /etc/security is configured
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target aix