STIGhubSTIGhub
STIGsSearchCompare

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • Release Notes
  • VPAT
  • DISA STIG Library
STIGs updated 6 hours ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

Release Date

Feb 6, 2026

SCAP Benchmark ID

IBM_AIX_7-x_STIG

Total Checks

283

Tags

other
CAT I: 26CAT II: 252CAT III: 5

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (283)

V-215169MEDIUMAIX /etc/security/mkuser.sys.custom file must not exist unless it is needed for customizing a new user account.V-215170MEDIUMAIX must automatically remove or disable temporary user accounts after 72 hours or sooner.V-215171MEDIUMAIX must enforce the limit of three consecutive invalid login attempts by a user before the user account is locked and released by an administrator.V-215172MEDIUMAIX must limit the number of concurrent sessions to 10 for all accounts and/or account types.V-215173MEDIUMIf the AIX system is using LDAP for authentication or account information, the LDAP SSL, or TLS connection must require the server provide a certificate and this certificate must have a valid path to a trusted CA.V-215174HIGHIf AIX is using LDAP for authentication or account information, the /etc/ldap.conf file (or equivalent) must not contain passwords.V-215175HIGHAll accounts on AIX system must have unique account names.V-215176HIGHAll accounts on AIX must be assigned unique User Identification Numbers (UIDs) and must authenticate organizational and non-organizational users (or processes acting on behalf of these users).V-215177HIGHThe AIX SYSTEM attribute must not be set to NONE for any account.V-215178MEDIUMDirect logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.V-215179HIGHAIX must use the SSH server to implement replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.V-215180MEDIUMThe AIX system must automatically remove or disable emergency accounts after the crisis is resolved or 72 hours.V-215181MEDIUMThe shipped /etc/security/mkuser.sys file on AIX must not be customized directly.V-215182MEDIUMThe regular users default primary group must be staff (or equivalent) on AIX.V-215183MEDIUMAll system files, programs, and directories must be owned by a system account.V-215184MEDIUMAIX device files and directories must only be writable by users with a system account or as configured by the vendor.V-215186MEDIUMAIX must configure the ttys value for all interactive users.V-215187MEDIUMAIX must provide the lock command to let users retain their session lock until users are reauthenticated.V-215188MEDIUMAIX must provide xlock command in the CDE environment to let users retain their sessions lock until users are reauthenticated.V-215189MEDIUMAIX system must prevent the root account from directly logging in except from the system console.V-215190MEDIUMAll AIX public directories must be owned by root or an application account.V-215191MEDIUMAIX administrative accounts must not run a web browser, except as needed for local service administration.V-215192MEDIUMAIX default system accounts (with the exception of root) must not be listed in the cron.allow file or must be included in the cron.deny file, if cron.allow does not exist.V-215193MEDIUMThe AIX root account must not have world-writable directories in its executable search path.V-215194MEDIUMThe Group Identifiers (GIDs) reserved for AIX system accounts must not be assigned to non-system accounts as their primary group GID.V-215195MEDIUMUIDs reserved for system accounts must not be assigned to non-system accounts on AIX systems.V-215196MEDIUMThe AIX root accounts list of preloaded libraries must be empty.V-215197HIGHAIX must not have accounts configured with blank or null passwords.V-215198MEDIUMThe AIX root accounts home directory (other than /) must have mode 0700.V-215199MEDIUMThe AIX root accounts home directory must not have an extended ACL.V-215200MEDIUMAIX must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote login access to the system.V-215201MEDIUMThe Department of Defense (DoD) login banner must be displayed immediately prior to, or as part of, graphical desktop environment login prompts on AIX.V-215202MEDIUMThe Department of Defense (DoD) login banner must be displayed during SSH, sftp, and scp login sessions on AIX.V-215203MEDIUMAny publically accessible connection to AIX operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.V-215204HIGHIF LDAP is used, AIX LDAP client must use SSL to authenticate with LDAP server.V-215205MEDIUMIf LDAP authentication is required, AIX must setup LDAP client to refresh user and group caches less than a day.V-215206MEDIUMThe AIX /etc/passwd, /etc/security/passwd, and/or /etc/group files must not contain a plus (+) without defining entries for NIS+ netgroups or LDAP netgroups.V-215207MEDIUMAIX must protect the confidentiality and integrity of all information at rest.V-215208MEDIUMAIX must provide time synchronization applications that can synchronize the system clock to external time sources at least every 24 hours.V-215209MEDIUMAll AIX NFS anonymous UIDs and GIDs must be configured to values without permissions.V-215210MEDIUMAIX nosuid option must be enabled on all NFS client mounts.V-215211MEDIUMAIX must be configured to allow users to directly initiate a session lock for all connection types.V-215212MEDIUMAIX CDE must conceal, via the session lock, information previously visible on the display with a publicly viewable image.V-215213HIGHAIX must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions.V-215214MEDIUMIf LDAP authentication is required on AIX, SSL must be used between LDAP clients and the LDAP servers to protect the integrity of remote access sessions.V-215215MEDIUMAIX must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.V-215216MEDIUMAIX must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.V-215217HIGHAIX must enforce password complexity by requiring that at least one upper-case character be used.V-215218HIGHAIX must enforce password complexity by requiring that at least one lower-case character be used.V-215219HIGHAIX must enforce password complexity by requiring that at least one numeric character be used.V-215220HIGHAIX must require the change of at least 50% of the total number of characters when passwords are changed.V-215221HIGHAIX root passwords must never be passed over a network in clear text form.V-215222MEDIUMAIX Operating systems must enforce 24 hours/1 day as the minimum password lifetime.V-215223MEDIUMAIX Operating systems must enforce a 60-day maximum password lifetime restriction.V-215225HIGHAIX must use Loadable Password Algorithm (LPA) password hashing algorithm.V-215226HIGHAIX must enforce a minimum 15-character password length.V-215227MEDIUMAIX must enforce password complexity by requiring that at least one special character be used.V-215229MEDIUMAIX must prevent the use of dictionary words for passwords.V-215230MEDIUMThe password hashes stored on AIX system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.V-215231MEDIUMIf SNMP service is enabled on AIX, the default SNMP password must not be used in the /etc/snmpd.conf config file.V-215232MEDIUMAIX must require passwords to contain no more than three consecutive repeating characters.V-215233HIGHAIX must be able to control the ability of remote login for users.V-215234MEDIUMNFS file systems on AIX must be mounted with the nosuid option unless the NFS file systems contain approved setuid or setgid programs.V-215235MEDIUMAIX removable media, remote file systems, and any file system not containing approved device files must be mounted with the nodev option.V-215236MEDIUMAIX must produce audit records containing information to establish what the date, time, and type of events that occurred.V-215237MEDIUMAIX must produce audit records containing information to establish where the events occurred.V-215238MEDIUMAIX must produce audit records containing information to establish the source and the identity of any individual or process associated with an event.V-215239MEDIUMAIX must produce audit records containing information to establish the outcome of the events.V-215240MEDIUMAIX must produce audit records containing the full-text recording of privileged commands.V-215241MEDIUMAIX must be configured to generate an audit record when 75% of the audit file system is full.V-215242MEDIUMAIX must provide the function to filter audit records for events of interest based upon all audit fields within audit records, support on-demand reporting requirements, and an audit reduction function that supports on-demand audit review and analysis and after-the-fact investigations of security incidents.V-215243MEDIUMAudit logs on the AIX system must be owned by root.V-215244MEDIUMAudit logs on the AIX system must be group-owned by system.V-215245MEDIUMAudit logs on the AIX system must be set to 660 or less permissive.V-215246MEDIUMAIX must provide audit record generation functionality for DoD-defined auditable events.V-215247MEDIUMAIX must start audit at boot.V-215248MEDIUMAIX audit tools must be owned by root.V-215249MEDIUMAIX audit tools must be group-owned by audit.V-215250MEDIUMAIX audit tools must be set to 4550 or less permissive.V-215251MEDIUMAIX must verify the hash of audit tools.V-215252MEDIUMAIX must provide the function for assigned ISSOs or designated SAs to change the auditing to be performed on all operating system components, based on all selectable event criteria in near real time.V-215253MEDIUMAIX must allocate audit record storage capacity to store at least one weeks worth of audit records, when audit records are not immediately sent to a central audit record storage facility.V-215254MEDIUMAIX must provide a report generation function that supports on-demand audit review and analysis, on-demand reporting requirements, and after-the-fact investigations of security incidents.V-215255MEDIUMAIX must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).V-215256MEDIUMAIX audit logs must be rotated daily.V-215257HIGHThe AIX rexec daemon must not be running.V-215258HIGHAIX telnet daemon must not be running.V-215259HIGHAIX ftpd daemon must not be running.V-215260HIGHAIX must remove NOPASSWD tag from sudo config files.V-215261MEDIUMAIX must remove !authenticate option from sudo config files.V-215262MEDIUMAIX must be configured with a default gateway for IPv4 if the system uses IPv4, unless the system is a router.V-215263MEDIUMIP forwarding for IPv4 must not be enabled on AIX unless the system is a router.V-215264MEDIUMAIX must be configured with a default gateway for IPv6 if the system uses IPv6 unless the system is a router.V-215265MEDIUMAIX must not have IP forwarding for IPv6 enabled unless the system is an IPv6 router.V-215266MEDIUMAIX log files must be owned by a system account.V-215267MEDIUMAIX log files must be owned by a system group.V-215268MEDIUMAIX system files, programs, and directories must be group-owned by a system group.V-215269MEDIUMThe inetd.conf file on AIX must be owned by root.V-215270MEDIUMAIX cron and crontab directories must be owned by root or bin.V-215271MEDIUMAIX audio devices must be group-owned by root, sys, bin, or system.V-215272MEDIUMAIX time synchronization configuration file must be owned by root.V-215273MEDIUMAIX time synchronization configuration file must be group-owned by bin, or system.V-215274MEDIUMThe AIX /etc/group file must be owned by root.V-215275MEDIUMThe AIX /etc/group file must be group-owned by security.V-215276MEDIUMAll AIX interactive users home directories must be owned by their respective users.V-215277MEDIUMAll AIX interactive users home directories must be group-owned by the home directory owner primary group.V-215278MEDIUMAll files and directories contained in users home directories on AIX must be group-owned by a group in which the home directory owner is a member.V-215279MEDIUMAIX library files must have mode 0755 or less permissive.V-215280MEDIUMSamba packages must be removed from AIX.V-215281MEDIUMAIX time synchronization configuration file must have mode 0640 or less permissive.V-215282MEDIUMThe AIX /etc/group file must have mode 0644 or less permissive.V-215283MEDIUMAIX must encrypt user data at rest using AIX Encrypted File System (EFS) if it is required.V-215284MEDIUMAIX must protect the confidentiality and integrity of transmitted information during preparation for transmission and maintain the confidentiality and integrity of information during reception and disable all non-encryption network access methods.V-215285MEDIUMAIX must monitor and record successful remote logins.V-215286MEDIUMAIX must monitor and record unsuccessful remote logins.V-215287MEDIUMOn AIX, the SSH server must not permit root logins using remote access programs.V-215288MEDIUMAll AIX shells referenced in passwd file must be listed in /etc/shells file, except any shells specified for the purpose of preventing logins.V-215289MEDIUMThe AIX SSH server must use SSH Protocol 2.V-215290MEDIUMAIX must config the SSH idle timeout interval.V-215291MEDIUMAIX must disable Kerberos Authentication in ssh config file to enforce access restrictions.V-215292MEDIUMIf GSSAPI authentication is not required on AIX, the SSH daemon must disable GSSAPI authentication.V-215293MEDIUMAIX must setup SSH daemon to disable revoked public keys.V-215294MEDIUMAIX SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.V-215295MEDIUMThe AIX SSH daemon must be configured for IP filtering.V-215296MEDIUMThe AIX SSH daemon must not allow compression.V-215297MEDIUMAIX must turn on SSH daemon privilege separation.V-215298MEDIUMAIX must turn on SSH daemon reverse name checking.V-215299MEDIUMAIX SSH daemon must perform strict mode checking of home directory configuration files.V-215300MEDIUMAIX must turn off X11 forwarding for the SSH daemon.V-215301MEDIUMAIX must turn off TCP forwarding for the SSH daemon.V-215302MEDIUMThe AIX SSH daemon must be configured to disable empty passwords.V-215303MEDIUMThe AIX SSH daemon must be configured to disable user .rhosts files.V-215304MEDIUMThe AIX SSH daemon must be configured to not use host-based authentication.V-215305MEDIUMThe AIX SSH daemon must not allow RhostsRSAAuthentication.V-215306MEDIUMIf AIX SSH daemon is required, the SSH daemon must only listen on the approved listening IP addresses.V-215308MEDIUMAIX system must require authentication upon booting into single-user and maintenance modes.V-215309LOWIf bash is used, AIX must display logout messages.V-215310LOWIf Bourne / ksh shell is used, AIX must display logout messages.V-215311LOWIf csh/tcsh shell is used, AIX must display logout messages.V-215312MEDIUMAIX must implement a remote syslog server that is documented using site-defined procedures.V-215313MEDIUMThe AIX syslog daemon must not accept remote messages unless it is a syslog server documented using site-defined procedures.V-215314MEDIUMAIX must be configured to use syslogd to log events by TCPD.V-215315MEDIUMThe AIX audit configuration files must be owned by root.V-215316MEDIUMThe AIX audit configuration files must be group-owned by audit.V-215317MEDIUMThe AIX audit configuration files must be set to 640 or less permissive.V-215318MEDIUMAIX must automatically lock after 15 minutes of inactivity in the CDE Graphical desktop environment.V-215320MEDIUMAIX must set inactivity time-out on login sessions and terminate all login sessions after 10 minutes of inactivity.V-215321MEDIUMAIX SSH private host key files must have mode 0600 or less permissive.V-215322HIGHAIX must disable /usr/bin/rcp, /usr/bin/rlogin, /usr/bin/rsh, /usr/bin/rexec and /usr/bin/telnet commands.V-215323MEDIUMAIX log files must have mode 0640 or less permissive.V-215324MEDIUMAIX log files must not have extended ACLs, except as needed to support authorized software.V-215325MEDIUMAll system command files must not have extended ACLs.V-215326MEDIUMAll library files must not have extended ACLs.V-215327MEDIUMAIX passwd.nntp file must have mode 0600 or less permissive.V-215328MEDIUMThe AIX /etc/group file must not have an extended ACL.V-215329MEDIUMThe AIX ldd command must be disabled.V-215330MEDIUMAIX NFS server must be configured to restrict file system access to local hosts.V-215331MEDIUMAll AIX users home directories must have mode 0750 or less permissive.V-215332MEDIUMThe AIX user home directories must not have extended ACLs.V-215333MEDIUMAIX must use Trusted Execution (TE) Check policy.V-215334HIGHAIX must disable trivial file transfer protocol.V-215335MEDIUMAIX must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.V-215336MEDIUMAIX must remove all software components after updated versions have been installed.V-215337MEDIUMAIX must enforce a delay of at least 4 seconds between login prompts following a failed login attempt.V-215338MEDIUMAIX system must restrict the ability to switch to the root user to members of a defined group.V-215339MEDIUMAll AIX Group Identifiers (GIDs) referenced in the /etc/passwd file must be defined in the /etc/group file.V-215340MEDIUMAll AIX files and directories must have a valid owner.V-215341MEDIUMThe sticky bit must be set on all public directories on AIX systems.V-215342MEDIUMThe AIX global initialization files must contain the mesg -n or mesg n commands.V-215343MEDIUMThe AIX hosts.lpd file must not contain a + character.V-215344MEDIUMAIX sendmail logging must not be set to less than nine in the sendmail.cf file.V-215345MEDIUMAIX run control scripts executable search paths must contain only absolute paths.V-215346HIGHThe AIX rsh daemon must be disabled.V-215347HIGHThe AIX rlogind service must be disabled.V-215348MEDIUMThe AIX qdaemon must be disabled if local or remote printing is not required.V-215349MEDIUMIf AIX system does not act as a remote print server for other servers, the lpd daemon must be disabled.V-215350MEDIUMIf AIX system does not support either local or remote printing, the piobe service must be disabled.V-215351MEDIUMIf there are no X11 clients that require CDE on AIX, the dt service must be disabled.V-215352MEDIUMIf NFS is not required on AIX, the NFS daemon must be disabled.V-215353MEDIUMIf sendmail is not required on AIX, the sendmail service must be disabled.V-215354MEDIUMIf SNMP is not required on AIX, the snmpd service must be disabled.V-215355MEDIUMThe AIX DHCP client must be disabled.V-215356MEDIUMIf DHCP is not enabled in the network on AIX, the dhcprd daemon must be disabled.V-215357MEDIUMIf IPv6 is not utilized on AIX server, the autoconf6 daemon must be disabled.V-215358MEDIUMIf AIX server is not functioning as a network router, the gated daemon must be disabled.V-215359MEDIUMIf AIX server is not functioning as a multicast router, the mrouted daemon must be disabled.V-215360MEDIUMIf AIX server is not functioning as a DNS server, the named daemon must be disabled.V-215361MEDIUMIf AIX server is not functioning as a network router, the routed daemon must be disabled.V-215362MEDIUMIf rwhod is not required on AIX, the rwhod daemon must be disabled.V-215363MEDIUMThe timed daemon must be disabled on AIX.V-215364MEDIUMIf AIX server does not host an SNMP agent, the dpid2 daemon must be disabled.V-215365MEDIUMIf SNMP is not required on AIX, the snmpmibd daemon must be disabled.V-215366MEDIUMThe aixmibd daemon must be disabled on AIX.V-215367MEDIUMThe ndpd-host daemon must be disabled on AIX.V-215368MEDIUMThe ndpd-router must be disabled on AIX.V-215369MEDIUMThe daytime daemon must be disabled on AIX.V-215370MEDIUMThe cmsd daemon must be disabled on AIX.V-215371MEDIUMThe ttdbserver daemon must be disabled on AIX.V-215372MEDIUMThe uucp (UNIX to UNIX Copy Program) daemon must be disabled on AIX.V-215373MEDIUMThe time daemon must be disabled on AIX.V-215374MEDIUMThe talk daemon must be disabled on AIX.V-215375HIGHThe ntalk daemon must be disabled on AIX.V-215376MEDIUMThe chargen daemon must be disabled on AIX.V-215377MEDIUMThe discard daemon must be disabled on AIX.V-215378MEDIUMThe dtspc daemon must be disabled on AIX.V-215379MEDIUMThe pcnfsd daemon must be disabled on AIX.V-215380MEDIUMThe rstatd daemon must be disabled on AIX.V-215381MEDIUMThe rusersd daemon must be disabled on AIX.V-215382MEDIUMThe sprayd daemon must be disabled on AIX.V-215383MEDIUMThe klogin daemon must be disabled on AIX.V-215384MEDIUMThe kshell daemon must be disabled on AIX.V-215385MEDIUMThe rquotad daemon must be disabled on AIX.V-215386MEDIUMThe tftp daemon must be disabled on AIX.V-215387MEDIUMThe imap2 service must be disabled on AIX.V-215388MEDIUMThe pop3 daemon must be disabled on AIX.V-215389MEDIUMThe finger daemon must be disabled on AIX.V-215390MEDIUMThe instsrv daemon must be disabled on AIX.V-215391MEDIUMThe echo daemon must be disabled on AIX.V-215392MEDIUMThe Internet Network News (INN) server must be disabled on AIX.V-215393MEDIUMIf Stream Control Transmission Protocol (SCTP) must be disabled on AIX.V-215394MEDIUMThe Reliable Datagram Sockets (RDS) protocol must be disabled on AIX.V-215395MEDIUMIf automated file system mounting tool is not required on AIX, it must be disabled.V-215396MEDIUMAIX process core dumps must be disabled.V-215397MEDIUMAIX kernel core dumps must be disabled unless needed.V-215398MEDIUMAIX must set Stack Execution Disable (SED) system wide mode to all.V-215399MEDIUMAIX must protect against or limit the effects of Denial of Service (DoS) attacks by ensuring AIX is implementing rate-limiting measures on impacted network interfaces.V-215400MEDIUMAIX must allow admins to send a message to all the users who logged in currently.V-215401MEDIUMAIX must allow admins to send a message to a user who logged in currently.V-215402MEDIUMThe AIX SSH daemon must be configured to only use FIPS 140-2 approved ciphers.V-215403HIGHThe AIX system must have no .netrc files on the system.V-215404MEDIUMAIX must turn on enhanced Role-Based Access Control (RBAC) to isolate security functions from nonsecurity functions, to grant system privileges to other operating system admins, and prohibit user installation of system software without explicit privileged status.V-215405MEDIUMIf DHCP server is not required on AIX, the DHCP server must be disabled.V-215406MEDIUMThe rwalld daemon must be disabled on AIX.V-215407MEDIUMIn the event of a system failure, AIX must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.V-215408MEDIUMThe /etc/shells file must exist on AIX systems.V-215409MEDIUMAIX public directories must be the only world-writable directories and world-writable files must be located only in public directories.V-215410MEDIUMAIX must be configured to only boot from the system boot device.V-215411MEDIUMAIX must not use removable media as the boot loader.V-215412LOWIf the AIX host is running an SMTP service, the SMTP greeting must not provide version information.V-215413LOWAIX must contain no .forward files.V-215414MEDIUMThe sendmail server must have the debug feature disabled on AIX systems.V-215415MEDIUMSMTP service must not have the EXPN or VRFY features active on AIX systems.V-215416MEDIUMAll global initialization file executable search paths must contain only absolute paths.V-215417MEDIUMThe SMTP service HELP command must not be enabled on AIX.V-215418MEDIUMNIS maps must be protected through hard-to-guess domain names on AIX.V-215419MEDIUMThe AIX systems access control program must be configured to grant or deny system access to specific hosts.V-215420MEDIUMAll AIX files and directories must have a valid group owner.V-215421MEDIUMAIX control scripts library search paths must contain only absolute paths.V-215422MEDIUMThe control script lists of preloaded libraries must contain only absolute paths on AIX systems.V-215423MEDIUMThe global initialization file lists of preloaded libraries must contain only absolute paths on AIX.V-215424MEDIUMThe local initialization file library search paths must contain only absolute paths on AIX.V-215425MEDIUMThe local initialization file lists of preloaded libraries must contain only absolute paths on AIX.V-215426MEDIUMAIX package management tool must be used daily to verify system software.V-215427MEDIUMThe AIX DHCP client must not send dynamic DNS updates.V-215428MEDIUMAIX must not run any routing protocol daemons unless the system is a router.V-215429MEDIUMAIX must not process ICMP timestamp requests.V-215430MEDIUMAIX must not respond to ICMPv6 echo requests sent to a broadcast address.V-215431MEDIUMAIX must define default permissions for all authenticated users in such a way that the user can only read and modify their own files.V-215432MEDIUMThere must be no .rhosts, .shosts, hosts.equiv, or shosts.equiv files on the AIX system.V-215433MEDIUMThe .rhosts file must not be supported in AIX PAM.V-215434MEDIUMThe AIX root user home directory must not be the root directory (/).V-215435MEDIUMAll AIX interactive users must be assigned a home directory in the passwd file and the directory must exist.V-215436MEDIUMThe AIX operating system must use Multi Factor Authentication.V-215437MEDIUMThe AIX operating system must be configured to authenticate using Multi Factor Authentication.V-215438MEDIUMThe AIX operating system must be configured to use Multi Factor Authentication for remote connections.V-215439MEDIUMAIX must have the have the PowerSC Multi Factor Authentication Product configured.V-215440MEDIUMThe AIX operating system must be configured to use a valid server_ca.pem file.V-215441MEDIUMThe AIX operating system must accept and verify Personal Identity Verification (PIV) credentials.V-219057MEDIUMAIX must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.V-219956MEDIUMAIX must be configured so that the audit system takes appropriate action when the audit storage volume is full.V-245557MEDIUMThe AIX /etc/hosts file must be owned by root.V-245558MEDIUMThe AIX /etc/hosts file must be group-owned by system.V-245559MEDIUMThe AIX /etc/hosts file must have a mode of 0640 or less permissive.V-245560MEDIUMAIX cron and crontab directories must have a mode of 0640 or less permissive.V-245561MEDIUMThe AIX /etc/syslog.conf file must be owned by root.V-245562MEDIUMThe AIX /etc/syslog.conf file must be group-owned by system.V-245563MEDIUMThe AIX /etc/syslog.conf file must have a mode of 0640 or less permissive.V-245564MEDIUMThe inetd.conf file on AIX must be group owned by the "system" group.V-245565MEDIUMThe AIX /etc/inetd.conf file must have a mode of 0640 or less permissive.V-245566MEDIUMThe AIX /var/spool/cron/atjobs directory must be owned by root or bin.V-245567MEDIUMThe AIX /var/spool/cron/atjobs directory must be group-owned by cron.V-245568MEDIUMThe AIX /var/spool/cron/atjobs directory must have a mode of 0640 or less permissive.V-245569MEDIUMThe AIX cron and crontab directories must be group-owned by cron.