Check: GEN008540
AIX 5.3 STIG:
GEN008540
(in version v1 r3)
Title
The system's local firewall must implement a deny-all, allow-by-exception policy. (Cat II impact)
Discussion
A local firewall protects the system from exposing unnecessary or undocumented network services to the local enclave. If a system within the enclave is compromised, firewall protection on an individual system continues to protect it from attack.
Check Content
Determine if the system's local firewall implements a deny-all, allow-by-exception policy. View the firewall (filter rules) with smit or lsfilt commands. # smitty ipsec4 # lsfilt If there is not a deny-all, allow-by-exception policy, this is a finding.
Fix Text
Configure the system's local firewall to implement a deny-all, allow-by-exception policy. Firewall rules can be added and activated with SMIT ipsec4 or genfilt command. #smitty ipsec4
Additional Identifiers
Rule ID: SV-38985r1_rule
Vulnerability ID: V-22583
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001109 |
The information system at managed interfaces denies network communications traffic by default and allows network communications traffic by exception (i.e., deny all, permit by exception). |
Controls
Number | Title |
---|---|
SC-7 (5) |
Deny By Default / Allow By Exception |