CIS IBM AIX 7.3 Benchmark

This recommendation verifies that Current Technology Level Is Applied on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

instfix -i | grep ML
oslevel -s
oslevel -r
# Verify current Technology Level and Service Pack

# Apply latest TL/SP:
install_all_updates -Y -d /path/to/updates

# Or via NIM:
nim -o cust -a lpp_source=<lpp_source> <client>

This recommendation verifies that Login Retry Limits Are Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/login.cfg -s default -a loginretries
# Should return: loginretries=3 or less

chsec -f /etc/security/login.cfg -s default -a loginretries=3

This recommendation verifies that Account Lockout Is Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/login.cfg -s default -a logindisable
# Should return: logindisable=5 or less

lssec -f /etc/security/login.cfg -s default -a logininterval

chsec -f /etc/security/login.cfg -s default -a logindisable=5
chsec -f /etc/security/login.cfg -s default -a logininterval=60

This recommendation verifies that Login Delay Is Set on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/login.cfg -s default -a logindelay
# Should return: logindelay=4 or higher (seconds)

chsec -f /etc/security/login.cfg -s default -a logindelay=4

This recommendation verifies that Password History Size Is Set on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/user -s default -a histsize
# Should return: histsize=20 or more

chsec -f /etc/security/user -s default -a histsize=20

This recommendation verifies that Password Age Limits Are Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/user -s default -a minage
# Should return: minage=1 or more (weeks)

lssec -f /etc/security/user -s default -a maxage
# Should return: maxage=13 or less (weeks)

chsec -f /etc/security/user -s default -a minage=1
chsec -f /etc/security/user -s default -a maxage=13
chsec -f /etc/security/user -s default -a maxexpired=2

This recommendation verifies that Minimum Password Length and Complexity on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/user -s default -a minlen
# Should return: minlen=14 or more

lssec -f /etc/security/user -s default -a minalpha
lssec -f /etc/security/user -s default -a minother

chsec -f /etc/security/user -s default -a minlen=14
chsec -f /etc/security/user -s default -a minalpha=2
chsec -f /etc/security/user -s default -a minother=2
chsec -f /etc/security/user -s default -a mindigit=1
chsec -f /etc/security/user -s default -a minspecialchar=1

This recommendation verifies that Minimum Character Differences Between Passwords on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssec -f /etc/security/user -s default -a mindiff
# Should return: mindiff=4 or more

chsec -f /etc/security/user -s default -a mindiff=4

This setting ensures that Maximum Repeating Characters Are Limited on the IBM AIX 7.3 Unix operating system. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the IBM AIX 7.3 Unix operating system is essential for defense in depth.

lssec -f /etc/security/user -s default -a maxrepeats
# Should return: maxrepeats=2 or less

lssec -f /etc/security/user -s default -a dictionlist

chsec -f /etc/security/user -s default -a maxrepeats=2
chsec -f /etc/security/user -s default -a dictionlist=/usr/share/dict/words

This recommendation verifies that Insecure inetd Services Are Disabled on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E '^telnet|^ftp|^rlogin|^rsh|^rexec' /etc/inetd.conf
# All should be commented out

lssrc -a | grep inetd

# Comment out insecure services in /etc/inetd.conf:
sed -i 's/^telnet/#telnet/' /etc/inetd.conf
sed -i 's/^ftp/#ftp/' /etc/inetd.conf
sed -i 's/^rlogin/#rlogin/' /etc/inetd.conf
sed -i 's/^rsh/#rsh/' /etc/inetd.conf
sed -i 's/^rexec/#rexec/' /etc/inetd.conf
refresh -s inetd

This recommendation verifies that Sendmail Is Disabled Unless Required on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

lssrc -s sendmail
# Should show: inoperative (unless mail server)

lssrc -g tcpip | grep sendmail

# Disable sendmail if not a designated mail server:
stopsrc -s sendmail
chrctcp -d sendmail

This recommendation verifies that SNMP Daemon Is Disabled Unless Required on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

lssrc -s snmpd
# Should show: inoperative

lssrc -g tcpip | grep snmp

stopsrc -s snmpd
chrctcp -d snmpd

This recommendation verifies that NFS Is Disabled Unless Required on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

lssrc -s nfsd
# Should show: inoperative (unless NFS server)

showmount -e localhost 2>/dev/null

stopsrc -s nfsd
stopsrc -s mountd
stopsrc -s rpc.statd
# Remove from startup:
chnfs -N off

This recommendation verifies that Print Daemon Is Disabled Unless Required on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

lssrc -s lpd
# Should show: inoperative (unless print server)

lssrc -g spooler

stopsrc -s lpd
chitab "lpd:2:off:/usr/lib/lpd/lpd"

This recommendation verifies that IP Forwarding Is Disabled on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

no -o ipforwarding
# Should return: ipforwarding = 0

no -o ip6forwarding
# Should return: ip6forwarding = 0

no -p -o ipforwarding=0
no -p -o ip6forwarding=0

This recommendation verifies that Send Redirects Are Disabled on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

no -o ipsendredirects
# Should return: ipsendredirects = 0

no -p -o ipsendredirects=0

This recommendation verifies that ICMP Redirects Are Ignored on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

no -o ipignoreredirects
# Should return: ipignoreredirects = 1

no -p -o ipignoreredirects=1

This recommendation verifies that Network Fragmentation Limits Are Set on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

no -o ip_nfrag
# Should return a reasonable limit (200 or less)

no -o tcp_sendspace
no -o tcp_recvspace

no -p -o ip_nfrag=200
no -p -o directed_broadcast=0
no -p -o clean_partial_conns=1

This recommendation verifies that Source Routing Is Disabled on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

no -o tcp_timewait
# Should return: tcp_timewait = 1 (15 seconds)

no -o ipsrcrouteforward
# Should return: 0

no -p -o ipsrcrouteforward=0
no -p -o ipsrcrouterecv=0
no -p -o ipsrcroutesend=0

This recommendation verifies that IPsec Filter Rules Are Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lsfilt -v4
# Review IPv4 filter rules

mkfilt -g active

# Add default deny rule:
genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c all -o any -p 0 -O any -P 0 -w B -l Y

# Allow SSH:
genfilt -v 4 -a P -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c tcp -o any -p 0 -O eq -P 22 -w I
mkfilt -u

This recommendation verifies that Default Deny Rule Exists on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lsfilt -v4 | tail -5
# Verify last rule is deny all

# Ensure default deny is the last rule:
genfilt -n
# Check if default deny exists, add if not:
genfilt -v 4 -a D -s 0.0.0.0 -m 0.0.0.0 -d 0.0.0.0 -M 0.0.0.0 -c all -o any -p 0 -O any -P 0 -w B
mkfilt -u

This recommendation verifies that AIX Audit Subsystem Is Enabled on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

audit query
# Verify auditing is enabled

lsaudit

# Initialize and start auditing:
audit start

# Configure audit on boot:
mkitab 'audit:2:once:/usr/sbin/audit start'

This recommendation verifies that Audit Events Are Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -v '^\*' /etc/security/audit/config | head -30
# Review audit events configuration

# Edit /etc/security/audit/config to add event classes:
# classes:
#   custom = LOGIN_Access,USER_SU,PASSWORD_Change,FILE_Unlink
# users:
#   default = custom

This recommendation verifies that Audit Syslog Output Is Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep 'syslog' /etc/security/audit/config
# Verify syslog output is configured

# In /etc/security/audit/config, add:
# start:
#   binmode = on
#   syslogmode = on

This recommendation verifies that Syslog Daemon Is Running on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lssrc -s syslogd
# Should show: active
grep -v '^#' /etc/syslog.conf | head -20

startsrc -s syslogd
# Ensure in /etc/inittab:
mkitab 'syslog:2:respawn:/usr/sbin/syslogd'

This recommendation verifies that Remote Syslog Forwarding Is Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep '@' /etc/syslog.conf
# Verify remote syslog forwarding is configured

echo '*.warning\t\t@loghost.example.com' >> /etc/syslog.conf
refresh -s syslogd

This recommendation verifies that SSH Root Login Is Disabled on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

grep -i '^PermitRootLogin' /etc/ssh/sshd_config
# Should return: PermitRootLogin no

sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
stopsrc -s sshd
startsrc -s sshd

This recommendation verifies that SSH PermitEmptyPasswords Is Disabled on the IBM AIX 7.3 Unix operating system. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM AIX 7.3 Unix operating system increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

grep -i '^PermitEmptyPasswords' /etc/ssh/sshd_config
# Should return: PermitEmptyPasswords no

sed -i 's/^#\?PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
stopsrc -s sshd && startsrc -s sshd

This recommendation verifies that SSH MaxAuthTries Is Set to 4 or Less on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i '^MaxAuthTries' /etc/ssh/sshd_config
# Should return: MaxAuthTries 4 or less

sed -i 's/^#\?MaxAuthTries.*/MaxAuthTries 4/' /etc/ssh/sshd_config
stopsrc -s sshd && startsrc -s sshd

This recommendation verifies that SSH Idle Timeout Is Configured on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i '^ClientAliveInterval' /etc/ssh/sshd_config
grep -i '^ClientAliveCountMax' /etc/ssh/sshd_config

sed -i 's/^#\?ClientAliveInterval.*/ClientAliveInterval 300/' /etc/ssh/sshd_config
sed -i 's/^#\?ClientAliveCountMax.*/ClientAliveCountMax 3/' /etc/ssh/sshd_config
stopsrc -s sshd && startsrc -s sshd

This recommendation verifies that Core System File Permissions Are Set on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ls -l /etc/passwd /etc/security/passwd /etc/group
# /etc/passwd: 644 root:security
# /etc/security/passwd: 600 root:security

chmod 644 /etc/passwd
chmod 600 /etc/security/passwd
chmod 644 /etc/group
chown root:security /etc/passwd /etc/security/passwd
chown root:security /etc/group

This recommendation verifies that No World-Writable Files Exist on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -type f -perm -0002 -ls 2>/dev/null | head -20
# Should return empty

find / -xdev -type f -perm -0002 -exec chmod o-w {} \;

This recommendation verifies that No Unowned Files Exist on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

find / -xdev -nouser -o -nogroup 2>/dev/null | head -20
# Should return empty

# Assign proper ownership:
find / -xdev -nouser -exec chown root {} \;
find / -xdev -nogroup -exec chgrp system {} \;

This recommendation verifies that No Accounts Have Empty Passwords on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

lsuser -a account_locked ALL | grep false
# Review accounts that are not locked

awk -F: '($2 == "") {print $1}' /etc/security/passwd

# Lock accounts with empty passwords:
awk -F: '($2 == "") {print $1}' /etc/security/passwd | while read user; do
  chuser account_locked=true "$user"
done

This recommendation verifies that Root Is the Only UID 0 Account on the IBM AIX 7.3 Unix operating system. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM AIX 7.3 Unix operating system vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

awk -F: '($3 == 0) {print $1}' /etc/passwd
# Should return only: root

# Change UID of non-root UID 0 accounts:
chuser id=<new_uid> <username>