AIX must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-215431	AIX7-00-003137	SV-215431r508663_rule		Medium

Description
Setting the most restrictive default permissions ensures that when new accounts are created they do not have unnecessary access.

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2021-11-19

Details

Check Text ( C-16629r294744_chk )
Check if "/etc/security/.profile" contains the proper "umask" setting by running the following command: # grep "umask 077" /etc/security/.profile umask 077 If the above command does not output the "umask 077", this is a finding. From the command prompt, run the following command to check if "umask=077" for the default stanza in "/etc/security/user": # lssec -f /etc/security/user -s default -a umask default umask=077 If the "umask" for the default stanza is not "077", or the "umask" is not set, this is a finding.

Check Text ( C-16629r294744_chk )

Check if "/etc/security/.profile" contains the proper "umask" setting by running the following command:
# grep "umask 077" /etc/security/.profile
umask 077

If the above command does not output the "umask 077", this is a finding.

From the command prompt, run the following command to check if "umask=077" for the default stanza in "/etc/security/user":
# lssec -f /etc/security/user -s default -a umask
default umask=077

If the "umask" for the default stanza is not "077", or the "umask" is not set, this is a finding.

Fix Text (F-16627r294745_fix)
Add the following line to "/etc/security/.profile": umask 077 Run the following command to set "umask=077" for the default stanza in "/etc/security/user": # chsec -f /etc/security/user -s default -a umask=077