← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215328

CAT II (Medium)

The AIX /etc/group file must not have an extended ACL.

Rule ID

SV-215328r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

The "/etc/group" file contains information regarding groups that are configured on the system. Protection of this file is important for system security.

Check Content

Check the ACL of the "/etc/group" file:
# aclget /etc/group 

The above command should yield the following output:
*
* ACL_type   AIXC
*
attributes: 
base permissions
    owner(root):  rw-
    group(security):  r--
    others:  r--
extended permissions
    disabled

If the extended ACL are not "disabled", this is a finding.

Fix Text

Remove the extended ACL from the "/etc/group" using command: 
# acledit /etc/group