OpenControls Logo

STIG Viewer

STIGViewer Support

Direct logins to the AIX system must not be permitted to shared accounts, default accounts, application accounts, and utility accounts.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-215178AIX7-00-001011SV-215178r1009531_ruleCCI-004045medium
Description
Shared accounts (accounts where two or more people log in with the same user identification) do not provide identification and authentication. There is no way to provide for non-repudiation or individual accountability.
STIGDate
IBM AIX 7.x Security Technical Implementation Guide2026-06-15

Related Frameworks

2 mappings across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-02.1Group Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (71) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-12Session Termination
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00

+61 more (top 10 by confidence shown)

CCI2 mappings
CCI-000770
1.00
CCI-004045
1.00

Details

Check Text (C-215178r1009531_chk)

Obtain a list of Shared/Application/Default/Utility accounts from the ISSO/ISSM. Shared/Application/Default/Utility accounts can have direct login disabled by setting the "rlogin" parameter to "false" in the user’s stanza of the "/etc/security/user" file. From the command prompt, run the following command to check if shared account has "rlogin=true": # lsuser -a rlogin [shared_account] <shared_account> rlogin=true If a shared account is configured for "rlogin=true", this is a finding.

Fix Text (F-16374r293986_fix)

Direct login to shared or application accounts can be prevented by setting the "rlogin=false" in the accounts stanza of the "/etc/security/user" file. From the command prompt, run the following command to set "rlogin=false" for a shared account: # chuser rlogin=false [shared_account]