Detections
Analytics

4.3.2.10 Ensure routed is not in use

Information

The routed daemon manages the network routing tables in the kernel.

The routed daemon should not be used as it only supports RIP1, it is recommended that the routed daemon is disabled to reduce the potential attack surface.

Should the AIX server need to communicate directly with routers (i.e., there is no default route but routes are managed by software) - the gated daemon should be used instead.

Solution

Run the following script to stop and disable routed

#!/usr/bin/ksh
DAEMONS="routed"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

NOTE: routed is provided by bos.net.tcp.server_core so it is not possible to remove this fileset.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-215358r958478_rule, Vuln-ID|V-215361

Plugin: Unix

Control ID: b17910e88850a5ddc54b3ba9aeab97622f8780e540b503cece2f3eb97c300df3