← Back to IBM AIX 7.x Security Technical Implementation Guide

V-215199

CAT II (Medium)

The AIX root accounts home directory must not have an extended ACL.

Rule ID

SV-215199r991592_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

Excessive permissions on root home directories allow unauthorized access to root user files.

Check Content

Verify the "root" account's home directory has no extended ACL using command:

# aclget ~root 
*
* ACL_type   AIXC
*
attributes:
base permissions
    owner(root):  rwx
    group(system):  ---
    others:  ---
extended permissions
    disabled

If extended permissions are enabled, the directory has an extended ACL, and this is a finding.

Fix Text

Remove the extended ACL from the "root" account's home directory using command:
# acledit ~root 

Change extended attributes to disabled.