Check: GEN003755
HP-UX 11.31 STIG:
GEN003755
(in versions v1 r19 through v1 r13)
Title
The xinetd.d directory must not have an extended ACL. (Cat II impact)
Discussion
The Internet service daemon configuration files must be protected as malicious modification could cause denial of service or increase the attack surface of the system.
Check Content
Check xinetd configuration directories for extended ACLs. Determine any xinetd configuration directories. # find / -type f -name xinetd.conf | xargs -n1 ls -lL # cat <PATH>/xinetd.conf | grep -v "^#" | grep includedir If xinetd.conf does not exist, or no includedir lines are returned, this is not applicable. Check the xinetd configuration directories for extended ACLs. # ls -lLd <included directories> If any of these directories contain a "+" in the permissions field, the directory has an extended ACL and this is a finding.
Fix Text
Remove the extended ACL from the xinetd configuration directories.
Additional Identifiers
Rule ID: SV-29790r1_rule
Vulnerability ID: V-22426
Group Title: GEN003755
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000225 |
The organization employs the concept of least privilege, allowing only authorized accesses for users (and processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. |
Controls
| Number | Title |
|---|---|
| AC-6 |
Least Privilege |