The root account must not be used for direct logins.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-11979	GEN001020	SV-40787r1_rule	ECPA-1	Medium

Description
Direct login with the root account prevents individual user accountability. Acceptable non-routine uses of the root account for direct login are limited to emergency maintenance, the use of single-user mode for maintenance, and situations where individual administrator accounts are not available.

STIG	Date
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2018-09-18

Details

Check Text ( C-39527r1_chk )
Check if the root is used for direct logins. Procedure: # last root | grep -v reboot If any direct login records for root exist, this is a finding.

Fix Text (F-11240r3_fix)
Enforce policy requiring all root account access is attained by first logging into a user account and then becoming root (using su, for example).