Detections
Analytics

4.6.1.3 Ensure dtlogin service is not available

Information

Do not start CDE automatically on system boot.

As the benchmark is intended for use on logical partitions which will not have a graphical console, CDE should not be started automatically to reduce the attack surface of the system.

Solution

Disable CDE start up:

/usr/dt/bin/dtconfig -d

End any current instances:

/usr/dt/bin/dtconfig -kill

NOTE: If CDE is not installed the command will not be found

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 01e3d514ffdfc03c48880af852781797014769b6b102738ef299d04e3af4f2e5