| GEN003320 - System accounts must not be listed in at.allow or must be included in at.deny - 'nuucp' | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003380 - The 'at' daemon must not execute programs in, or subordinate to, world-writable directories. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003490 - The at.deny file must be group-owned by system, bin, sys, or cron. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003510 - Kernel core dumps must be disabled unless needed - 'secondary dump device' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN003523 - The kernel core dump data directory must not have an extended ACL. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003601 - TCP backlog queue sizes must be set appropriately. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN003610 - The system must not send IPv4 ICMP redirects. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003623 - The system must use a separate file system for the system audit data path. | DISA STIG AIX 6.1 v1r14 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN003720 - The inetd.conf file, xinetd.conf file, and the xinetd.d directory must be owned by root or bin - 'inetd.conf' | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003770 - The services file must be group-owned by bin, sys, or system. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN003865 - Network analysis tools must not be installed - 'wireshark' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN003900 - The hosts.lpd file (or equivalent) must not contain a '+' character. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN004000 - The traceroute file must have mode 0700 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN004010 - The traceroute file must not have an extended ACL. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN004380 - The alias file must have mode 0644 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN004410 - Files executed through a mail aliases file must be group-owned by root, bin, sys, or other. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005040 - All FTP users must have a default umask of 077. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005100 - The TFTP daemon must have mode 0755 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005120 - The TFTP daemon must be configured to vendor specs including a home directory owned by the TFTP user - 'tftp user exists' | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005390 - The /etc/syslog.conf file must have mode 0640 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005512 - The SSH client must only use MACs employing FIPS 140-2 approved cryptographic hash algorithms | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005524 - The SSH daemon must not permit GSSAPI authentication unless needed. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005536 - The SSH daemon must perform strict mode checking of home directory configuration files. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005540 - The SSH daemon must be configured for IP filtering - '/etc/hosts.deny' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005760 - The NFS export configuration file must have mode 0644 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005840 - The NFS server must be configured to restrict file system access to local hosts - 'Exports containing rw should be reviewed' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005900 - The nosuid option must be enabled on all NFS client mounts. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006040 - The system must not have any peer-to-peer file-sharing application installed. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006100 - The /usr/lib/smb.conf file must be owned by root. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006240 - The system must not run an Internet Network News (INN) server. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN006280 - The /etc/news/hosts.nntp.nolimit (or equivalent) must have mode 0600 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006290 - The /etc/news/hosts.nntp.nolimit file must not have an extended ACL. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006320 - The /etc/news/passwd.nntp file (or equivalent) must have mode 0600 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006380 - The system must not use UDP for NIS/NIS+. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006560 - The system vulnerability assessment, host-based intrusion detection, and file integrity tools must notify of a security breach. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| GEN006570 - The file integrity tool must be configured to verify ACLs. | DISA STIG AIX 6.1 v1r14 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN006620 - The system's access control program must be configured to grant or deny system access to specific hosts - 'hosts.deny ALL:ALL' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007020 - The Stream Control Transmission Protocol (SCTP) must be disabled unless required. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007850 - The DHCP client must not send dynamic DNS updates - 'updateDNS exists in /etc/dhcpcd.ini' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007900 - The system must use an appropriate reverse-path filter for IPv6 network traffic, if the system uses IPv6. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN007950 - The system must not respond to ICMPv6 echo requests sent to a broadcast address. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008000 - Certificates used to authenticate to the LDAP server must be provided from DoD-approved external PKI - 'ldapsslkeyf exists' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008020 - The LDAP TLS connection must require a certificate and this certificate has a valid path to a trusted CA - 'useSSL = yes' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008050 - The /etc/ldap.conf file (or equivalent) must not contain passwords - 'ldapsslkeypwd: is not unencrypted' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008060 - If the system is using LDAP the /etc/ldap.conf file must have mode 0644 or less permissive | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN008200 - The LDAP TLS certificate authority file must not have an extended ACL | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN008480 - The system must have USB Mass Storage disabled unless needed. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008540 - The system's local firewall must implement a deny-all, allow-by-exception policy. | DISA STIG AIX 6.1 v1r14 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN008640 - The system must not use removable media as the boot loader - 'prevboot' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008640 - The system must not use removable media as the boot loader - 'service' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
