STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

The Internet Network News (INN) server must be disabled on AIX.

DISA Rule

SV-215392r508663_rule

Vulnerability Number

V-215392

Group Title

SRG-OS-000095-GPOS-00049

Rule Version

AIX7-00-003087

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

To stop "innd" or "nntpd" from running, use the following commands:
# stopsrc -s innd
# stopsrc -s nntpd

Some versions of "innd" and "nntpd" need the following commands to stop them:
# kill -1 [innd_pid]
# kill -1 [nntpd_pid]

To remove "innd" and 'nntpd" from SRC, run the following commands:
# rmssys -s innd
# rmssys -s nntpd

To stop running "innd" and "nntpd" from "/etc/inetd.conf", comment out the "innd" and "nntpd" lines in "/etc/inetd.conf", then refresh the "inetd":
# refresh -s inetd

Check Contents

From the command prompt, run the following command:
# ps -ef | egrep "innd|nntpd"

If the above command produced any result, this is a finding.

Check if "innd" or "nntpd" is started from "/etc/onetd.conf" using the following command:
# egrep "innd|nntpd" /etc/inetd.conf | grep -v ^#

If the above command produced any result, this is a finding.

Check if "innd" or "nntpd" is added as a subsystem to the System Resource Controller (SRC):
# lssrc -s innd
# lssrc -s nntpd

If the above commands found that "innd" or "nntpd" is defined in SRC, this is a finding.

Vulnerability Number

V-215392

Documentable

False

Rule Version

AIX7-00-003087

Severity Override Guidance

From the command prompt, run the following command:
# ps -ef | egrep "innd|nntpd"

If the above command produced any result, this is a finding.

Check if "innd" or "nntpd" is started from "/etc/onetd.conf" using the following command:
# egrep "innd|nntpd" /etc/inetd.conf | grep -v ^#

If the above command produced any result, this is a finding.

Check if "innd" or "nntpd" is added as a subsystem to the System Resource Controller (SRC):
# lssrc -s innd
# lssrc -s nntpd

If the above commands found that "innd" or "nntpd" is defined in SRC, this is a finding.

Check Content Reference

M

Target Key

4012

Comments