The at.deny file must have mode 0640 or less permissive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22392	GEN003252	SV-38787r1_rule	ECLP-1	Medium

Description
The at daemon control files restrict access to scheduled job manipulation and must be protected. Unauthorized modification of the at.deny file could result in Denial of Service to authorized at users or provide unauthorized users with the ability to run at jobs.

STIG	Date
AIX 6.1 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2018-09-18

Details

Check Text ( C-37211r1_chk )
Determine the mode of the at.deny file. # ls -lL /var/adm/cron/at.deny If the mode of the at.deny file is more permissive than 0640, this is a finding.

Fix Text (F-32478r1_fix)
Change the mode of the at.deny file to 0640. # chmod 0640 /var/adm/cron/at.deny