PCI 2.2.4 - Remove all unnecessary functionality - CDE - 'de-installing CDE'

800-53|CM-7b.

PCI 2.2.4 - Remove all unnecessary functionality - NFS - 'de-install NFS'

PCI 2.2.4 - Remove all unnecessary functionality - NIS - 'bos.net.nis.client is not installed'

CSCv6|9.1

PCI 2.2.4 - Remove all unnecessary functionality - NIS - 'bos.net.nis.server is not installed'

PCI 2.2.4 - Verify that common security parameter settings are included - '/etc/environment PATH does not include dot'

800-53|CM-7(2)

PCI 2.2.4 - Verify that common security parameter settings are included - '/etc/motd contains the appropriate text'

800-53|AC-8

PCI 2.2.4 - Verify that common security parameter settings are included - '/etc/profile PATH does not include dot'

PCI 2.2.4 - Verify that common security parameter settings are included - '~root/.profile PATH does not include dot'

PCI 2.2.4 - Verify that common security parameter settings are included - 'default herald is set to appropriate text'

800-53|AC-8a.

PCI 2.2.4 - Verify that common security parameter settings are included - 'default umask = 27'

800-53|AC-3(4)(d)

PCI 2.2.4 - Verify that common security parameter settings are included - 'hosts.equiv has no entries'

800-53|CM-6b.

PCI 2.2.4 - Verify that common security parameter settings are included - 'no group or world writable directories in root PATH'

800-53|AC-6

PCI 2.2.4 - Verify that common security parameter settings are included - 'no SUID or SGID files exist'

800-53|AC-6(8)

PCI 2.2.4 - Verify that common security parameter settings are included - 'no unowned files exist'

800-53|AC-16(3)

PCI 2.2.4 - Verify that common security parameter settings are included - 'no world writable directories exist'

PCI 2.2.4 - Verify that common security parameter settings are included - 'no world writable files exist'

PCI 2.2.4 - Verify that common security parameter settings are included - 'on:/usr/sbin/getty does not exist in /etc/inittab'

PCI 2.2.4 - Verify that common security parameter settings are included - 'rcp mode 000'

800-53|CM-6

CSCv6|3.1

PCI 2.2.4 - Verify that common security parameter settings are included - 'rlogin mode 000'

PCI 2.2.4 - Verify that common security parameter settings are included - 'rlogind mode 000'

PCI 2.2.4 - Verify that common security parameter settings are included - 'rsh mode 000'

PCI 2.2.4 - Verify that common security parameter settings are included - 'rshd mode 000'

PCI 2.2.4 - Verify that common security parameter settings are included - 'tftpd mode 000'

PCI 2.2.4 - Verify that common security parameter settings are included - at access - 'at.deny does not exist'

800-53|AC-6(10)

PCI 2.2.4 - Verify that common security parameter settings are included - at permissions - '/var/adm/cron/at.allow root:sys 400'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'at.allow contains @USERNAME@'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'at.allow contains adm'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'at.allow contains sys'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'at.allow includes root'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'only root, sys, adm, @USERNAME@'

800-53|AC-6(2)

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in at.allow - 'only root, sys, adm'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'cron.allow contains @USERNAME@'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'cron.allow contains adm'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'cron.allow contains sys'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'cron.allow includes root'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'only root, sys, adm, @USERNAME@'

PCI 2.2.4 - Verify that common security parameter settings are included - authorized users in cron.allow - 'only root,sys,adm'

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - 'disabling dtlogin'

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - 'Dtlogin.servers = /etc/dt/config/Xservers'

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - 'dtsession*lockTimeout <= 10'

800-53|AC-11

CSCv6|16.5

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - 'dtsession*saverTimeout <= 10'

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - 'remote GUI login disabled'

800-53|AC-17a.

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtaction permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtappgather permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtlogin*greeting.labelString is set to appropriate text

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtlogin*greeting.persLabelString is set to appropriate text

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtprintinfo permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - dtsession permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - Xconfig permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - Xresources permissions

PCI 2.2.4 - Verify that common security parameter settings are included - CDE - Xservers permissions

PCI 2.2.4 - Verify that common security parameter settings are included - compress permissions - '/usr/lib/spell/compress 755'

PCI 2.2.4 - Verify that common security parameter settings are included - crontab access - 'cron.deny does not exist'

PCI 2.2.4 - Verify that common security parameter settings are included - crontab permissions - '/var/adm/cron/cron.allow root:sys 400'

PCI 2.2.4 - Verify that common security parameter settings are included - crontab permissions - '/var/adm/cron/log root:cron 660'

PCI 2.2.4 - Verify that common security parameter settings are included - crontab permissions - '/var/spool/cron/crontabs/ root:cron 770'

PCI 2.2.4 - Verify that common security parameter settings are included - disable core dumps - 'core = 0'

PCI 2.2.4 - Verify that common security parameter settings are included - disable core dumps - 'core_hard = 0'

PCI 2.2.4 - Verify that common security parameter settings are included - disable core dumps - 'fullcore false'

PCI 2.2.4 - Verify that common security parameter settings are included - dumpcheck permissions - '/usr/lib/ras/dumpcheck 755'

PCI 2.2.4 - Verify that common security parameter settings are included - errclear permissions - '/usr/bin/errclear 755'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains adm'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains bin'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains daemon'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains guest'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains invscout'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains lp'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains lpd'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains nuucp'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains sys'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers contains uucp'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - '/etc/ftpusers includes root'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - 'ftp banner is set to appropriate text'

PCI 2.2.4 - Verify that common security parameter settings are included - FTP - 'ftp umask at least 027'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '.netrc does not exist'

800-53|IA-5(7)

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '.rhosts does not exist'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.bash_logout not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.bash_profile not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.bashrc not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.cschrc not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.dispatch not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.dtprofile not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.emacs not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.env not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.exrc not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.login not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.logout not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - '~/.profile not world write'

PCI 2.2.4 - Verify that common security parameter settings are included - Home directory configuration - 'not allow group or world write'

PCI 2.2.4 - Verify that common security parameter settings are included - inetd.conf permissions - '/etc/inetd.conf permissions are secure'

PCI 2.2.4 - Verify that common security parameter settings are included - motd permissions - '/etc/motd bin:bin 644'

PCI 2.2.4 - Verify that common security parameter settings are included - NFS - 'all entries in /etc/exports contain sec='

800-53|SI-7(6)

PCI 2.2.4 - Verify that common security parameter settings are included - NFS - 'all exported filesystems have explicit access defined'

PCI 2.2.4 - Verify that common security parameter settings are included - NFS - 'All NFS client mounts have nosuid option'

PCI 2.2.4 - Verify that common security parameter settings are included - NFS - 'no anon options exist in /etc/exports'

PCI 2.2.4 - Verify that common security parameter settings are included - NFS - 'no localhost references exist in /etc/exports'

PCI 2.2.4 - Verify that common security parameter settings are included - NIS - '/etc/group does not include NIS + entries'

800-53|IA-2

PCI 2.2.4 - Verify that common security parameter settings are included - NIS - '/etc/passwd does not include NIS + entries'

PCI 2.2.4 - Verify that common security parameter settings are included - NIS - '/var/yp/securenets includes allowed subnets'

800-53|SC-7(11)

PCI 2.2.4 - Verify that common security parameter settings are included - NIS - '/var/yp/securenets includes no other subnets'

Revision 1.27

Mar 4, 2019

Functional Update

Miscellaneous