| GEN000000-AIX00040 - The securetcpip command must be used. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN000000-AIX0085 - The /etc/netsvc.conf file must be root owned. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN000000-AIX0230 - The system must provide protection against IP fragmentation attacks. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN000000-AIX0320 - The /etc/ftpaccess.ctl file must be owned by root. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GEN000000-AIX0330 - The /etc/ftpaccess.ctl file must be group-owned by bin, sys, or system. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL, CONFIGURATION MANAGEMENT |
| GEN000020 - The system must require authentication upon booting into single-user and maintenance modes. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN000220 - A file integrity tool must be used at least weekly to check for unauthorized file, system libraries or binaries changes. | DISA STIG AIX 6.1 v1r14 | Unix | RISK ASSESSMENT |
| GEN000240 - The system clock must be synchronized to an authoritative DoD time source - 'xntpd is started at boot time' | DISA STIG AIX 6.1 v1r14 | Unix | AUDIT AND ACCOUNTABILITY |
| GEN004010 - The traceroute file must not have an extended ACL. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN004380 - The alias file must have mode 0644 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN004410 - Files executed through a mail aliases file must be group-owned by root, bin, sys, or other. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005040 - All FTP users must have a default umask of 077. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005100 - The TFTP daemon must have mode 0755 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005120 - The TFTP daemon must be configured to vendor specs including a home directory owned by the TFTP user - 'tftp user exists' | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005390 - The /etc/syslog.conf file must have mode 0640 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005512 - The SSH client must only use MACs employing FIPS 140-2 approved cryptographic hash algorithms | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005524 - The SSH daemon must not permit GSSAPI authentication unless needed. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005536 - The SSH daemon must perform strict mode checking of home directory configuration files. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005540 - The SSH daemon must be configured for IP filtering - '/etc/hosts.deny' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005590 - The system must not be running any routing protocol daemons, unless the system is a router. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005610 - The system must not have IP forwarding for IPv6 enabled, unless the system is an IPv6 router. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005760 - The NFS export configuration file must have mode 0644 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN005840 - The NFS server must be configured to restrict file system access to local hosts - 'Exports containing rw should be reviewed' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN005900 - The nosuid option must be enabled on all NFS client mounts. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006040 - The system must not have any peer-to-peer file-sharing application installed. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006100 - The /usr/lib/smb.conf file must be owned by root. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006240 - The system must not run an Internet Network News (INN) server. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN006280 - The /etc/news/hosts.nntp.nolimit (or equivalent) must have mode 0600 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006290 - The /etc/news/hosts.nntp.nolimit file must not have an extended ACL. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006320 - The /etc/news/passwd.nntp file (or equivalent) must have mode 0600 or less permissive. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006380 - The system must not use UDP for NIS/NIS+. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN006560 - The system vulnerability assessment, host-based intrusion detection, and file integrity tools must notify of a security breach. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY |
| GEN006570 - The file integrity tool must be configured to verify ACLs. | DISA STIG AIX 6.1 v1r14 | Unix | SYSTEM AND INFORMATION INTEGRITY |
| GEN006620 - The system's access control program must be configured to grant or deny system access to specific hosts - 'hosts.deny ALL:ALL' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007020 - The Stream Control Transmission Protocol (SCTP) must be disabled unless required. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007850 - The DHCP client must not send dynamic DNS updates - 'updateDNS exists in /etc/dhcpcd.ini' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN007900 - The system must use an appropriate reverse-path filter for IPv6 network traffic, if the system uses IPv6. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN007950 - The system must not respond to ICMPv6 echo requests sent to a broadcast address. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008000 - Certificates used to authenticate to the LDAP server must be provided from DoD-approved external PKI - 'ldapsslkeyf exists' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008020 - The LDAP TLS connection must require a certificate and this certificate has a valid path to a trusted CA - 'useSSL = yes' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008050 - The /etc/ldap.conf file (or equivalent) must not contain passwords - 'ldapsslkeypwd: is not unencrypted' | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN008060 - If the system is using LDAP the /etc/ldap.conf file must have mode 0644 or less permissive | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN008200 - The LDAP TLS certificate authority file must not have an extended ACL | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN008480 - The system must have USB Mass Storage disabled unless needed. | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008540 - The system's local firewall must implement a deny-all, allow-by-exception policy. | DISA STIG AIX 6.1 v1r14 | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| GEN008640 - The system must not use removable media as the boot loader - 'prevboot' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN008640 - The system must not use removable media as the boot loader - 'service' | DISA STIG AIX 6.1 v1r14 | Unix | CONFIGURATION MANAGEMENT |
| GEN009120 - The system, if capable, must be configured to require the use of a CAC, PIV compliant hardware token, or Alternate Logon Token. | DISA STIG AIX 6.1 v1r14 | Unix | IDENTIFICATION AND AUTHENTICATION |
| GEN009210 - The system must not have the discard service active. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
| GEN009240 - The system must not have Internet Message Access Protocol (IMAP) service active. | DISA STIG AIX 6.1 v1r14 | Unix | ACCESS CONTROL |
