STIGQter: STIG Summary: IBM AIX 7.x Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 23 Apr 2021:

AIX must protect against or limit the effects of Denial of Service (DoS) attacks by ensuring AIX is implementing rate-limiting measures on impacted network interfaces.

DISA Rule

SV-215399r508663_rule

Vulnerability Number

V-215399

Group Title

SRG-OS-000420-GPOS-00186

Rule Version

AIX7-00-003097

Severity

CAT II

CCI(s)

• CCI-002385 - The information system protects against or limits the effects of organization-defined types of denial of service attacks by employing organization-defined security safeguards.

Weight

10

Fix Recommendation

Make sure "bos.net.tcp.client_core" package is installed on the system.

Set the Network performance tuning attribute value for "clean_partial_connections to "1" to avoid SYN attacks.
# /usr/sbin/no -o clean_partial_conns=1

Check Contents

Check to see if bos.net.tcp.client_core package is installed:

# lslpp -l | grep bos.net.tcp.client_core
bos.net.tcp.client_core 7.2.1.1 COMMITTED TCP/IP Client Core Support
bos.net.tcp.client_core 7.2.1.1 COMMITTED TCP/IP Client Core Support

If the packages are not "COMMITTED", this is a finding.

Check that the value set for "clean_partial_conns" is "1":

# /usr/sbin/no -o clean_partial_conns
clean_partial_conns = 1

If the value returned is "0", this is a finding.

Vulnerability Number

V-215399

Documentable

False

Rule Version

AIX7-00-003097

Severity Override Guidance

Check to see if bos.net.tcp.client_core package is installed:

# lslpp -l | grep bos.net.tcp.client_core
bos.net.tcp.client_core 7.2.1.1 COMMITTED TCP/IP Client Core Support
bos.net.tcp.client_core 7.2.1.1 COMMITTED TCP/IP Client Core Support

If the packages are not "COMMITTED", this is a finding.

Check that the value set for "clean_partial_conns" is "1":

# /usr/sbin/no -o clean_partial_conns
clean_partial_conns = 1

If the value returned is "0", this is a finding.

Check Content Reference

M

Target Key

4012

Comments