Detections
Analytics

4.3.2.6 Ensure hostmibd is not in use

Information

The hostmibd daemon is a dpi2 sub-agent which manages a number of MIB variables which may be required if the server runs SNMP.

The specific MIB variables which are managed by hostmibd are defined by RFC 2790. Details relating to these MIBS can be found in: https://www.ibm.com/docs/en/aix/7.2?topic=h-hostmibd-daemon

Unless a system is specifically set up to provide SNMP services, it is recommended that the snmpd fileset be removed to reduce the potential attack surface.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u bos.net.tcp.snmpd bos.net.tcp.server

- OR -

- IF - the bos.net.tcp.snmpd fileset is required as a dependency:

Run the following script to stop and disable hostmibd

#!/usr/bin/ksh
DAEMONS="hostmibd"
for l_daemon in $DAEMONS;
do
 /usr/sbin/chrctcp -d $l_daemon
 /usr/bin/stopsrc -s $l_daemon
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CCI|CCI-000381, CSCv7|9.2

Plugin: Unix

Control ID: 57d73127145be2639618e667cda26889998ae6729e17e382be3a432d3e3ca0e8