Detections
Analytics
AIX7-00-001000 - AIX /etc/security/mkuser.sys.custom file must not exist unless it is needed for customizing a new user account.
Information
The "/etc/security/mkuser.sys.custom" is called by "/etc/security/mkuser.sys" to customize the new user account when a new user is created, or a user is logging into the system without a home directory. An improper "/etc/security/mkuser.sys.custom" script increases the risk that non-privileged users may obtain elevated privileges. It must not exist unless it is needed.Solution
Remove the "/etc/security/mkuser.sys.custom" file using the following command:# rm /etc/security/mkuser.sys.custom
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R2_STIG.zip
Item Details
Audit Name: DISA IBM AIX 7.x STIG v3r2
Category: ACCESS CONTROL
References: 800-53|AC-2(1), CAT|II, CCI|CCI-000015, Rule-ID|SV-215169r958362_rule, STIG-ID|AIX7-00-001000, STIG-Legacy|SV-101313, STIG-Legacy|V-91213, Vuln-ID|V-215169
Plugin: Unix
Control ID: 211be6d2bfa2d5d215ce07178a9c3917b2420d49acbea64390267941a21e7509