OpenControls Logo

STIG Viewer

STIGViewer Support

AIX must provide the lock command to let users retain their session lock until users are reauthenticated.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-215187AIX7-00-001028SV-215187r958400_ruleCCI-000056medium
Description
All systems are vulnerable if terminals are left logged in and unattended. Leaving system terminals unsecure poses a potential security hazard. To lock the terminal, use the lock command.
STIGDate
IBM AIX 7.x Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AU-10Non-repudiation
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00
IA-2(2)Multi-factor Authentication to Non-privileged Accounts
1.00
IA-2(3)Local Access to Privileged Accounts
1.00
IA-2(4)Local Access to Non-privileged Accounts
1.00

+5 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000056
1.00

Details

Check Text (C-215187r958400_chk)

Check the system to determine if "bos.rte.security" is installed: # lslpp -L bos.rte.security Fileset Level State Type Description (Uninstaller) ---------------------------------------------------------------------------- bos.rte.security 7.2.1.1 C F Base Security Function If the "bos.rte.security" fileset is not installed, this is a finding. Check if lock command exist using the following command: # ls /usr/bin/lock The above command should display the following: /usr/bin/lock If the above command does not show that "/usr/bin/lock" exists, this is a finding.

Fix Text (F-16383r294013_fix)

Install "bos.rte.security" fileset from the AIX DVD Volume 1 using the following command (assuming that the DVD device is mounted to /dev/cd0): # installp -aXYgd /dev/cd0 -e /tmp/install.log bos.rte.security