Detections
Analytics

10.1 SN.1 Restrict access to suspend feature

Information

Solaris 11 does not enable the suspend capability by default and now uses the poweradm command to suspend the system.

Bear in mind that users with physical access to a system can simply remove power from the machine if they are truly motivated to take the system off-line, and granting the capability to use poweradm may be a more graceful way of allowing desktop users to shut down their own machines.

Solution

Perform the following to implement the recommended state:

# poweradm set suspend-enable=false

# poweradm update

See Also

https://workbench.cisecurity.org/benchmarks/4777

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1

Plugin: Unix

Control ID: e65f2bfa1eabfa0b28be2cef94d7c9d4f70cae292802dc910c410278b2f8df48