Detections
Analytics
GEN001374 - The /etc/nsswitch.conf file must not have an extended ACL.
Information
The nsswitch.conf file (or equivalent) configures the source of a variety of system security information including account, group, and host lookups. Malicious changes could prevent the system from functioning or compromise system security.NOTE: AIX does not use the /etc/nsswitch.conf file. This check is not applicable.
Solution
Remove the extended ACL from the /etc/nsswitch.conf file.# acledit /etc/nsswitch.conf
See Also
https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip
Item Details
Audit Name: DISA STIG AIX 6.1 v1r14
Category: ACCESS CONTROL
References: 800-53|AC-6, CAT|II, CCI|CCI-000225, Group-ID|V-22330, Rule-ID|SV-39334r1_rule, STIG-ID|GEN001374, Vuln-ID|V-22330
Plugin: Unix
Control ID: fa08c41145225a946c675c4332ce2a3b82eae12d4899290e1103861532b10e41