Ensure inetd daemon is disabled when no additional services are required

中级别 1自动化aix

说明

When none of the services run and managed by inetd are required then disable the inetd daemon itself. This is the preferred state. When no inetd managed services are required there is no need to start the daemon at boot time. An administrator can manually start the inetd service post-IPL, should any of the inetd supported services are/become required. Audit: the inetd start line in /etc/rc.tcpip must be commented out and the inetd subsystem must not be active.

检查方式

审计方法: Shell 命令

shell

command -v lssrc >/dev/null 2>&1 || exit 1; [ -r /etc/rc.tcpip ] || exit 1; out=$( { grep -E "^[[:blank:]]*start[[:blank:]]+/usr/(sbin|lib)/inetd([[:blank:]]|$)" /etc/rc.tcpip; lssrc -s inetd | awk 'NR>1 && $NF=="active"' ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Review any active inetd services: refresh -s inetd lssrc -ls inetd NOTE: If there are active services and the services are required, do not disable inetd. Skip to the next section and consider the implementation of TCP Wrappers to secure access to these active services. If the active services are not required disable them via the chsubserver command. Disable inetd if there are no active services: chrctcp -d inetd stopsrc -s inetd

属性

操作系统: 任意
标签: aixservices
参考: CIS IBM AIX 7 Benchmark v1.2.0 - 4.3.2.1 Ensure inetd daemon is disabled when no additional services are required

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target aix