Details

The SYSTEM attribute in /etc/security/user defines the mechanisms used to authenticate specific user accounts. If the value is set to NONE, other attributes will be used to determine the authentication mechanisms, but if these attributes are not present, no authentication will be performed. To ensure authentication is always used for the system’s accounts, the SYSTEM attribute must always be set to a valid setting other than NONE.

Solution

Edit /etc/security/user and change any SYSTEM=NONE settings to a valid authentication setting.

Supportive Information

The following resource is also helpful.

• https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control, Identification and Authentication.This control applies to the following type of system Unix.

References

• 800-53|AC-6
• 800-53|IA-2
• CAT|I
• CCI|CCI-000225
• CCI|CCI-000764
• Group-ID|V-12035
• Rule-ID|SV-12536r2_rule
• STIG-ID|GEN000000-AIX00080
• Vuln-ID|V-12035

Source

• Tenable.com/audits