TMA-AIX-2.6
Ensure regular scans for unauthorized applications
说明
This recommendation is find and report (audit) software on the system that has not been included in the TE (trusted execution) TSD (trusted signature database). These entries establish a so-called AllowList. Software not included on this AllowList should be generating a syslog and/or audit record whenever it is executed.
检查方式
审计方法: 人工审核
此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。
The following command will locate the software AIX considers untrusted aka TROJAN. Note: the output goes to stderr so stderr is first joined to stdout and thereafter stdout get redirected to /dev/null. The argument -i instructs the scan to ignore NFS mounts. trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted
修复方式
修复方法: 操作指南或基础设施补丁
This will be a manual process. The remediation is to find and remove the offending file (currently the reported file might be the artifact of another error - most common is a symbolic link that points at a non-existent object). The starting point is running the same command from the AUDIT section: trustchk -i -n tree / 2>&1 >/dev/null | grep untrusted Line by line, verify the root cause and act (one of): remove the offending object remove SUID/SGID settings remove privcmds setting add to TSD aka AllowList
属性
- 操作系统
- 任意
- 标签
- aixhardening
- 参考
- CIS IBM AIX 7 Benchmark v1.2.0 - 2.6 Ensure regular scans for unauthorized applications