Detections
Analytics

DISA STIG AIX 7.x v3r1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: DISA STIG AIX 7.x v3r1

Updated: 7/7/2026

Authority: DISA STIG

Plugin: Unix

Revision: 1.1

Estimated Item Count: 284

File Details

Filename: DISA_STIG_AIX_7.x_v3r1.audit

Size: 506 kB

MD5: c5b2d6a51222be390c49fd525700b383
SHA256: a13aa8b7a51d3bb087cc3c88541d864dbc1ed9eb133323f52aa994f26184266d

Audit Items

DescriptionCategories
AIX7-00-001000 - AIX /etc/security/mkuser.sys.custom file must not exist unless it is needed for customizing a new user account.
AIX7-00-001001 - AIX must automatically remove or disable temporary user accounts after 72 hours or sooner.
AIX7-00-001003 - AIX must enforce the limit of three consecutive invalid login attempts by a user before the user account is locked and released by an administrator.
AIX7-00-001004 - AIX must limit the number of concurrent sessions to 10 for all accounts and/or account types.
AIX7-00-001006 - If the AIX system is using LDAP for authentication or account information, the LDAP SSL, or TLS connection must require the server provide a certificate and this certificate must have a valid path to a trusted CA.
AIX7-00-001007 - If AIX is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.
AIX7-00-001008 - All accounts on AIX system must have unique account names.
AIX7-00-001009 - All accounts on AIX must be assigned unique User Identification Numbers (UIDs) and must authenticate organizational and non-organizational users (or processes acting on behalf of these users).
AIX7-00-001010 - The AIX SYSTEM attribute must not be set to NONE for any account.
AIX7-00-001011 - Direct logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.
AIX7-00-001012 - AIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
AIX7-00-001014 - The AIX system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.
AIX7-00-001015 - The shipped /etc/security/mkuser.sys file on AIX must not be customized directly.
AIX7-00-001016 - The regular users default primary group must be staff (or equivalent) on AIX.
AIX7-00-001018 - All system files, programs, and directories must be owned by a system account.
AIX7-00-001019 - AIX device files and directories must only be writable by users with a system account or as configured by the vendor.
AIX7-00-001025 - AIX must configure the ttys value for all interactive users.
AIX7-00-001028 - AIX must provide the lock command to let users retain their session lock until users are reauthenticated.
AIX7-00-001029 - AIX must provide xlock command in the CDE environment to let users retain their sessions lock until users are reauthenticated.
AIX7-00-001030 - AIX system must prevent the root account from directly logging in except from the system console.
AIX7-00-001031 - All AIX public directories must be owned by root or an application account.
AIX7-00-001032 - AIX administrative accounts must not run a web browser, except as needed for local service administration.
AIX7-00-001033 - AIX default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.
AIX7-00-001034 - The AIX root account must not have world-writable directories in its executable search path.
AIX7-00-001035 - The Group Identifiers (GIDs) reserved for AIX system accounts must not be assigned to non-system accounts as their primary group GID.
AIX7-00-001036 - UIDs reserved for system accounts must not be assigned to non-system accounts on AIX systems.
AIX7-00-001037 - The AIX root accounts list of preloaded libraries must be empty.
AIX7-00-001038 - AIX must not have accounts configured with blank or null passwords.
AIX7-00-001039 - The AIX root accounts home directory (other than /) must have mode 0700.
AIX7-00-001040 - The AIX root accounts home directory must not have an extended ACL.
AIX7-00-001041 - AIX must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote login access to the system.
AIX7-00-001042 - The Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts on AIX.
AIX7-00-001043 - The Department of Defense (DoD) login banner must be displayed during SSH, sftp, and scp login sessions on AIX.
AIX7-00-001044 - Any publically accessible connection to AIX operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.
AIX7-00-001045 - IF LDAP is used, AIX LDAP client must use SSL to authenticate with LDAP server.
AIX7-00-001046 - If LDAP authentication is required, AIX must setup LDAP client to refresh user and group caches less than a day.
AIX7-00-001047 - The AIX /etc/passwd, /etc/security/passwd, and/or /etc/group files must not contain a plus (+) without defining entries for NIS+ netgroups or LDAP netgroups.
AIX7-00-001048 - AIX must protect the confidentiality and integrity of all information at rest.
AIX7-00-001053 - AIX must provide time synchronization applications that can synchronize the system clock to external time sources at least every 24 hours.
AIX7-00-001055 - All AIX NFS anonymous UIDs and GIDs must be configured to values without permissions.
AIX7-00-001056 - AIX nosuid option must be enabled on all NFS client mounts.
AIX7-00-001100 - AIX must be configured to allow users to directly initiate a session lock for all connection types.
AIX7-00-001101 - AIX CDE must conceal, via the session lock, information previously visible on the display with a publicly viewable image.
AIX7-00-001102 - AIX must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.
AIX7-00-001104 - If LDAP authentication is required on AIX, SSL must be used between LDAP clients and the LDAP servers to protect the integrity of remote access sessions.
AIX7-00-001105 - AIX must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
AIX7-00-001108 - AIX must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
AIX7-00-001120 - AIX must enforce password complexity by requiring that at least one upper-case character be used.
AIX7-00-001121 - AIX must enforce password complexity by requiring that at least one lower-case character be used.
AIX7-00-001122 - AIX must enforce password complexity by requiring that at least one numeric character be used.