STIGQter STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

AIX removable media, remote file systems, and any file system not containing approved device files must be mounted with the nodev option.

DISA Rule

SV-215235r508663_rule

Vulnerability Number

V-215235

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

AIX7-00-001139

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit "/etc/filesystems" and add the "options = nodev" to all entries for remote or removable media file systems, and file systems containing no approved device files.

Check Contents

Identify any file system mounted from removable media, network shares, or file systems not containing any approved device files:

# cat /etc/filesystems

/:

dev = /dev/hd4
vfs = jfs2
log = /dev/hd8
mount = automatic
check = false
type = bootfs
vol = root
free = true

/home:

dev = /dev/hd1
vol = "/home"
mount = true
check = true
free = false
vfs = jfs2
log = /dev/hd8

10.17.76.74:/opt/nfs /home/doejohn

vfs = nfs
log = /dev/hd8
mount = true
options = nodev
account = false

If any file system mounted from removable media, network shares, or file systems not containing any approved device files is not using the "nodev" option, this is a finding.

Vulnerability Number

V-215235

Documentable

False

Rule Version

AIX7-00-001139

Severity Override Guidance

Identify any file system mounted from removable media, network shares, or file systems not containing any approved device files:

# cat /etc/filesystems

/:

dev = /dev/hd4
vfs = jfs2
log = /dev/hd8
mount = automatic
check = false
type = bootfs
vol = root
free = true

/home:

dev = /dev/hd1
vol = "/home"
mount = true
check = true
free = false
vfs = jfs2
log = /dev/hd8

10.17.76.74:/opt/nfs /home/doejohn

vfs = nfs
log = /dev/hd8
mount = true
options = nodev
account = false

If any file system mounted from removable media, network shares, or file systems not containing any approved device files is not using the "nodev" option, this is a finding.

Check Content Reference

M

Target Key

4012

Comments