Detections
Analytics

AIX7-00-002112 - The AIX SSH daemon must be configured for IP filtering.

Information

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses.

Solution

Add appropriate IP restrictions for SSH to the "/etc/hosts.deny" and/or "/etc/hosts.allow" files.

TCP Wrappers can be installed from the AIX Expansion Pack by installing fileset "netsec.options.tcpwrappers" using the following command (assume AIX Expansion Pack is mounted on /dev/cd0):
# installp -aXYgd /dev/cd0 -e /tmp/install.log netsec.options.tcpwrappers

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-215295r1009551_rule, STIG-ID|AIX7-00-002112, STIG-Legacy|SV-101777, STIG-Legacy|V-91679, Vuln-ID|V-215295

Plugin: Unix

Control ID: d3aa3926355a14244527c65bf7fb37c8e51c182e5fc38f51032a50cc74877e13