TMA-AIX-4.3.2.1
Ensure inetd daemon is disabled when no additional services are required
Mô tả
When none of the services run and managed by inetd are required then disable the inetd daemon itself. This is the preferred state. When no inetd managed services are required there is no need to start the daemon at boot time. An administrator can manually start the inetd service post-IPL, should any of the inetd supported services are/become required. Audit: the inetd start line in /etc/rc.tcpip must be commented out and the inetd subsystem must not be active.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/inetd([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s inetd | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Review any active inetd services: refresh -s inetd lssrc -ls inetd NOTE: If there are active services and the services are required, do not disable inetd. Skip to the next section and consider the implementation of TCP Wrappers to secure access to these active services. If the active services are not required disable them via the chsubserver command. Disable inetd if there are no active services: chrctcp -d inetd stopsrc -s inetd
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- aixservices
- Tham chiếu
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.1 Ensure inetd daemon is disabled when no additional services are required
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target aix