The Internet Network News (INN) server must be disabled on AIX.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-215392 | AIX7-00-003087 | SV-215392r958478_rule | CCI-000381 | medium |
| Description | ||||
| Internet Network News (INN) servers access Usenet newsfeeds and store newsgroup articles. INN servers use the Network News Transfer Protocol (NNTP) to transfer information from the Usenet to the server and from the server to authorized remote hosts. If this function is necessary to support a valid mission requirement, its use must be authorized and approved in the system accreditation package. | ||||
| STIG | Date | |||
| IBM AIX 7.x Security Technical Implementation Guide | 2024-08-16 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.6
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000381
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-215392r958478_chk)
From the command prompt, run the following command:
# ps -ef | egrep "innd|nntpd"
If the above command produced any result, this is a finding.
Check if "innd" or "nntpd" is started from "/etc/onetd.conf" using the following command:
# egrep "innd|nntpd" /etc/inetd.conf | grep -v ^#
If the above command produced any result, this is a finding.
Check if "innd" or "nntpd" is added as a subsystem to the System Resource Controller (SRC):
# lssrc -s innd
# lssrc -s nntpd
If the above commands found that "innd" or "nntpd" is defined in SRC, this is a finding.
Fix Text (F-16588r294628_fix)
To stop "innd" or "nntpd" from running, use the following commands:
# stopsrc -s innd
# stopsrc -s nntpd
Some versions of "innd" and "nntpd" need the following commands to stop them:
# kill -1 [innd_pid]
# kill -1 [nntpd_pid]
To remove "innd" and 'nntpd" from SRC, run the following commands:
# rmssys -s innd
# rmssys -s nntpd
To stop running "innd" and "nntpd" from "/etc/inetd.conf", comment out the "innd" and "nntpd" lines in "/etc/inetd.conf", then refresh the "inetd":
# refresh -s inetd