STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

If bash is used, AIX must display logout messages.

DISA Rule

SV-215309r508663_rule

Vulnerability Number

V-215309

Group Title

SRG-OS-000281-GPOS-00111

Rule Version

AIX7-00-002128

Severity

CAT III

CCI(s)

• CCI-002364 - The information system displays an explicit logout message to users indicating the reliable termination of authenticated communications sessions.

Weight

10

Fix Recommendation

Create the ".bash_logout" file if it does not exist.

Add the following two lines to ".bash_logout" to display a logout message and sleep for "5" seconds:
echo "You are being disconnected."
sleep 5

Check Contents

Identify any users that are using the BASH shell:

# cut -d: -f1,7 /etc/passwd | grep -i bash
doejohn:/bin/bash

If no users are assigned the BASH shell, this is Not Applicable

Verify that each BASH shell user has a ".bash_logout" file:

# for home in `cut -d: -f6 /etc/passwd`; do ls -alL $home/.bash_logout; done
-rwxr----- 1 doejohn staff 297 Jan 29 09:47 /home/doejohn/.bash_logout

If a user does not have their ".bash_logout" file, this is a finding.

Verify that each ".bash_logout" file identified above contains a logout message:

# cat <user_home_directory>/.bash_logout
echo "You are being disconnected."
sleep 5

If the ".bash_logout" file is not configured to display a logout message, this is a finding.

Vulnerability Number

V-215309

Documentable

False

Rule Version

AIX7-00-002128

Severity Override Guidance

Identify any users that are using the BASH shell:

# cut -d: -f1,7 /etc/passwd | grep -i bash
doejohn:/bin/bash

If no users are assigned the BASH shell, this is Not Applicable

Verify that each BASH shell user has a ".bash_logout" file:

# for home in `cut -d: -f6 /etc/passwd`; do ls -alL $home/.bash_logout; done
-rwxr----- 1 doejohn staff 297 Jan 29 09:47 /home/doejohn/.bash_logout

If a user does not have their ".bash_logout" file, this is a finding.

Verify that each ".bash_logout" file identified above contains a logout message:

# cat <user_home_directory>/.bash_logout
echo "You are being disconnected."
sleep 5

If the ".bash_logout" file is not configured to display a logout message, this is a finding.

Check Content Reference

M

Target Key

4012

Comments