Detections
Analytics

4.6.1.8 Ensure CDE login screen hostname is masked

Information

The Dtlogin*greeting.labelString parameter is the message displayed in the first dialogue box on the CDE login screen. This is where the username is entered.

The Dtlogin*greeting.persLabelString is the message displayed in the second dialogue box on the CDE login screen. This is where the password is entered.

Potential hackers may gain access to valuable information such as the hostname and the version of the operating system from the default AIX login screen. This information would assist hackers in choosing the exploitation methods to break into the system. For security reasons, change the login screen default messages.

Solution

Copy the files from /usr/dt/config/*/Xresources to /etc/dt/config/*/Xresources and add the Dtlogin*greeting.labelString and Dtlogin*greeting.persLabelString parameters to all copied Xresources files:

for file in /usr/dt/config/*/Xesources; do
 etc_file=`echo $file | sed -e s/usr/etc/`
 echo "\nupdating config file "$etc_file"..."
 if [[ ! -f $etc_file ]]; then
 dir=`dirname $file | sed -e s/usr/etc/`
 mkdir -p $dir
 cp $file $etc_file
 fi

 WARN="Authorized uses only. All activity may be monitored and reported."
 cp $etc_file $etc_file.bak
 grep -v 'Dtlogin\*greeting.labelString:' $etc_file > $etc_file.sav
 grep -v 'Dtlogin\*greeting.persLabelString:' $etc_file.sav > $etc_file
 echo "Dtlogin*greeting.labelString: $WARN" >> $etc_file
 echo "Dtlogin*greeting.persLabelString: $WARN" >> $etc_file
 rm $etc_file.sav
done

 WARN="Authorized uses only. All activity may be monitored and reported."
 echo "Dtlogin*greeting.labelString: $WARN" >> $dir/Xresources
 echo "Dtlogin*greeting.persLabelString: $WARN" >> $dir/Xresources
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., Rule-ID|SV-215201r958390_rule

Plugin: Unix

Control ID: 4312ee6b124d88c9fb1a279133f19de5149fd61389d11c74a51f772843c47ff9