All shell files must be owned by root or bin.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-921	GEN002200	SV-38847r1_rule	ECLP-1	Medium

Description
If shell files are owned by users other than root or bin, they could be modified by intruders or malicious users to perform unauthorized actions.

STIG	Date
Draft AIX Security Technical Implementation Guide	2011-08-17

Details

Check Text ( C-37840r1_chk )
Obtain a list of system shells from /etc/security/login.cfg and check the ownership of these shells. Procedure: #grep shells /etc/security/login.cfg \| grep –v \* \| cut –f 2 –d = \| sed s/,/\ /g \| xargs –n1 ls –l If any shell is not owned by root or bin, this is a finding. Obtain a list of system shells from /etc/shells and check the ownership of these shells. Procedure: #cat /etc/shells \| xargs –n1 ls -l If any shell is not owned by root or bin, this is a finding.

Check Text ( C-37840r1_chk )

Obtain a list of system shells from /etc/security/login.cfg and check the ownership of these shells.
Procedure:
#grep shells /etc/security/login.cfg | grep –v \* | cut –f 2 –d = | sed s/,/\ /g | xargs –n1 ls –l
If any shell is not owned by root or bin, this is a finding.

Obtain a list of system shells from /etc/shells and check the ownership of these shells.
Procedure:
#cat /etc/shells | xargs –n1 ls -l
If any shell is not owned by root or bin, this is a finding.

Fix Text (F-33103r1_fix)
Change the ownership of the shell with incorrect ownership. # chown root < shell >