Access to a domain console via telnet must be restricted to the local host.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-216348 | SOL-11.1-040315 | SV-216348r959010_rule | CCI-000366 | medium |
| Description | ||||
| Telnet is an insecure protocol. | ||||
| STIG | Date | |||
| Solaris 11 SPARC Security Technical Implementation Guide | 2025-05-05 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · 3 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · 3 · disa_xccdf · related
Details
Check Text (C-216348r959010_chk)
This action applies only to the control domain.
Determine the domain that you are currently securing.
# virtinfo
Domain role: LDoms control I/O service root
The current domain is the control domain, which is also an I/O domain, the service domain, and a root I/O domain.
If the current domain is not the control domain, this check does not apply.
Determine if vnsd is in use.
# svcs vntsd
STATE STIME FMRI
online Oct_08 svc:/ldoms/vntsd:default
If the state is not "online", this is not applicable.
Determine if a role has been created for domain console access.
# cat /etc/user_attr | grep solaris.vntsd.consoles
rolename::::type=role;auths=solaris.vntsd.consoles;profiles=All;roleauth=role
If a role for "vntsd.consoles" is not established, this is a finding.
Fix Text (F-17582r371133_fix)
The root role is required. This action applies only to the control domain.
Determine the domain that you are currently securing.
# virtinfo
Domain role: LDoms control I/O service root
The current domain is the control domain, which is also an I/O domain, the service domain, and a root I/O domain.
If the current domain is not the control domain, this action does not apply.
Create a password-controlled role that has the solaris.vntsd.consoles authorization, which permits access to all domain consoles.
# roleadd -A solaris.vntsd.consoles [role-name]
# passwd [role-name]
Assign the new role to a user.
# usermod -R [role-name] [username]