Details

The ‘/etc/security/mkuser.sys.custom’ is called by ‘/etc/security/mkuser.sys’ to customize the new user account when a new user is created, or a user is logging into the system without a home directory. An improper ‘/etc/security/mkuser.sys.custom’ script increases the risk that non-privileged users may obtain elevated privileges. It must not exist unless it is needed.

Solution

Remove the ‘/etc/security/mkuser.sys.custom’ file using the following command:

# rm /etc/security/mkuser.sys.custom

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V2R3_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-2(1)
• CAT|II
• CCI|CCI-000015
• CSCv6|9.1
• Rule-ID|SV-215169r508663_rule
• STIG-ID|AIX7-00-001000
• STIG-Legacy|SV-101313
• STIG-Legacy|V-91213
• Vuln-ID|V-215169

Source

• Tenable.com/audits