UCF STIG Viewer Logo

The .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files must not contain a plus (+) without defining entries for NIS+ netgroups.


Overview

Finding ID Version Rule ID IA Controls Severity
V-11987 GEN001980 SV-38740r1_rule ECCD-1 ECCD-2 Medium
Description
A plus (+) in system accounts files causes the system to lookup the specified entry using NIS. If the system is not using NIS, no such entries should exist.
STIG Date
AIX 5.3 SECURITY TECHNICAL IMPLEMENTATION GUIDE 2014-10-03

Details

Check Text ( C-37175r1_chk )
Check system configuration files for plus (+) entries.

Procedure:
# find / -name .rhosts
# cat //.rhosts | grep -v "^#" | grep "\+"

# find / -name .shosts
# cat //.shosts | grep -v "^#" | grep "\+"

# find / -name hosts.equiv
# cat //hosts.equiv | grep -v "^#" | grep "\+"

# find / -name shosts.equiv
# cat //shosts.equiv | grep -v "^#" | grep "\+"

# cat /etc/passwd | grep -v "^#" | grep "\+"
# cat /etc/security/passwd | grep -v "^#" | grep "\+"
# cat /etc/group | grep -v "^#" | grep "\+"

If the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/shadow, and/or /etc/group files contain a plus (+) and do not define entries for NIS+ netgroups, this is a finding.
Fix Text (F-32455r1_fix)
Edit the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, /etc/security/passwd, and/or /etc/group files and remove entries containing a plus (+).