Work these in order: FAIL before WARN, then native severity high, med, and low; original finding order breaks ties.
| Priority | Finding | Observed evidence | Fix | Severity | CIS L1 check | CVE tier |
|---|---|---|---|---|---|---|
| 1 | Error log (7 days) errpt_recent — FAIL | 26 error entries (9 informational ignored) (recurring E18E984F x21) | triage 'errpt' now, most recent and most frequent first. | high | — | — |
| 2 | OS backup (mksysb) evidence mksysb_age — FAIL | /image.data older than 90 days | run a mksysb now; schedule it; verify the target is itself backed up. | high | — | — |
| 3 | SSH root login ssh_rootlogin — FAIL | permitrootlogin yes | set 'PermitRootLogin no' (or prohibit-password) in sshd_config and restart sshd. | high | — | — |
| 4 | Trust files (.rhosts) rhosts — FAIL | present: /.rhosts | remove /.rhosts and /etc/hosts.equiv; rely on key-based ssh instead. | high | — | — |
| 5 | root account controls privileged_access — FAIL | rlogin=true + sugroups=ALL (root wide open) | restrict both: 'chsec -f /etc/security/user -s root -a rlogin=false' (admins log in as themselves and su/sudo to root) and '-a sugroups=<sysadmin-group>' so only a named group may su to root. | high | — | — |
| 6 | STIG file permissions stig_fileperms — FAIL | 7 of 11 rules compliant, 0 not applicable; failing: V-215269 /etc/inetd.conf (0664), V-215281 /etc/ntp.conf (0664), V-245559 /etc/hosts (0664), V-245563 /etc/syslog.conf (0644) | chmod/chown the failing files to the required mode/owner per the rule list (chmod <maxmode> <path>; chown <owner>:<group> <path>); the compliance report lists every rule and its evidence. | high | 4.1.1.3 FAIL 4.1.1.2 PASS | — |
| 7 | STIG account policy stig_secattr — FAIL | 5 of 12 rules compliant, 1 n/a; failing: V-215171 loginretries=0 (needs le 3), V-215220 mindiff=0 (needs ge 8), V-215223 maxage=13 (needs le 8), V-215224 histsize=4 (needs ge 5), V-215226 minlen=10 (needs ge 15), +2 more | tighten the failing attributes with chsec (chsec -f <file> -s default -a <attr>=<value>); the compliance report lists every rule, the required value, and the observed value. | high | — | — |
| 8 | STIG network tunables stig_nettune — FAIL | 3 of 4 rules compliant, 0 n/a; failing: V-215399 clean_partial_conns=0 (needs eq 1) | set the failing tunables with 'no -p -o <tunable>=<value>' (nfso for NFS options) so the change persists across reboot; the compliance report lists every rule, the required value, and the observed value. | high | 4.5.6 PASS 4.5.7 PASS 4.5.3 FAIL 4.5.2 PASS | — |
| 9 | STIG disabled services stig_svcoff — FAIL | 34 of 37 rules compliant, 0 n/a; failing: V-215353 sendmail, V-215354 snmpd, V-215365 snmpmibd | comment the service out of /etc/inetd.conf and 'refresh -s inetd' (inetd services), or 'stopsrc -s <subsystem>' and disable it at boot (SRC subsystems); the compliance report lists every rule and its evidence. | high | — | — |
| 10 | Other filesystems fs_other — FAIL | /opt 94%; repo (informational): /usr/sys/inst.images 100% | free space or extend them; add monitoring. | med | — | — |
| 11 | SNMP community strings snmp_community — FAIL | default community in use | replace public/private with a strong community in /etc/snmpd.conf and refresh snmpd. | med | — | — |
| 12 | Time synchronization (NTP) ntp — FAIL | xntpd inoperative, 0 server(s) | configure /etc/ntp.conf with a server and start xntpd ('startsrc -s xntpd'; enable at boot). | med | — | — |
| 13 | System firmware currency firmware — WARN | VL950_168 — family FW950 current; hardware support ended 2026-01-31; firmware UAK valid through 2026-09-16 | review IBM FLRT/Fix Central for machine type 9008, renew a near-expiry UAK, and schedule the supported firmware/hardware path named above. | high | — | — |
| 14 | rootvg redundancy rootvg_mirror — WARN | 1 disk, unmirrored | mirror rootvg (mirrorvg + bosboot + bootlist) or document the storage-level protection. | high | — | — |
| 15 | Alternate rootvg clone alt_disk — WARN | status=NOT_APPLICABLE; usable=null; volume_group=null; disks=[]; reason=lspv reported no altinst_rootvg or old_rootvg; source_commands=[lspv] | create and regularly refresh an alt_disk_copy clone of rootvg on a platform-bootable alternate disk; verify it with alt_rootvg_op and bootlist. | high | — | — |
| 16 | Default password policy pw_policy — WARN | weak: loginretries=0 | tighten the /etc/security/user default stanza (maxage 1-13wk, minlen>=8, loginretries>0, histsize>0). | high | — | — |
| 17 | Audit subsystem audit_active — WARN | auditing off | configure and start audit ('audit start'; set it to start at boot). | high | — | — |
| 18 | Monitoring agent monitoring_agent — WARN | no KNOWN monitoring agent detected (checked: Zabbix agent, Nagios NRPE, Prometheus node_exporter, IBM Tivoli/ITM kuxagent, collectd, njmon/nimon, Datadog agent) | confirm monitoring coverage; if none exists, install and point a monitoring agent at this LPAR. | high | — | — |
| 19 | Hardware generation hw_gen — WARN | 9008-22L (POWER9) — hardware support ended 2026-01-31 (fully-virtual LPAR) | confirm who owns the hardware (IBM on PowerVS; your team on-prem), then plan or request a host refresh to current-generation IBM Power11 hardware; the host change is outside this LPAR. | med | — | — |
| 20 | JFS2 filesystem-buffer blocking fsbuf_blocking — WARN | blocked since boot: jfs2 fsbuf 1656, external-pager 370, client 0 | re-read 'vmstat -v' after a busy period: if the number is still climbing, raise JFS2 buffers with 'ioo -p -o j2_dynamicBufferPreallocation=<n>' (default 16, in 16KB units) and/or 'ioo -p -o numfsbufs=<n>'; a static non-zero count from a past burst is usually benign. | med | — | — |
| 21 | Dump copy directory dump_copy_dir — WARN | copy dir /var/adm/ras has 215 MB free, estimated dump 1359 MB | free space in /var/adm/ras or point the copy directory at a filesystem with room for the dump ('sysdumpdev -D <dir>'), sized to 'sysdumpdev -e'. | med | — | — |
| 22 | Failed login attempts failed_logins — WARN | 16539 recorded (lifetime total) | review recency ('who /etc/security/failedlogin | tail') and rotate the log; lock or investigate the source accounts/hosts. | med | — | — |
| 23 | Network exposure vs filtering network_exposure — WARN | 12 external listener(s) on ports 22,25,111,199,657,1334,2049,32768 +3 more; host IP filtering INACTIVE | reduce the surface first (stop services you do not need — see the listeners and cleartext-inetd checks), then, if the box must self-defend, define rules with 'genfilt'/'mkfilt' and activate host filtering with 'mkfilt -v4 -u'. | med | — | — |
| 24 | NFS exports nfs_exports — WARN | exportfs: nothing exported | add an explicit access= host list and use ro unless the clients genuinely require writes; re-export only through the normal approved change process. | med | 4.4.1.6 PASS | — |
| 25 | Error notification errpt_notify — WARN | 26 errnotify stanzas (defaults only) | add an errnotify ODM stanza that emails or pages on PERM hardware and disk errors. | med | — | — |
| 26 | Scheduled backup job backup_job — WARN | no backup in crontab | schedule mksysb/savevg in root's crontab, or confirm NIM/central backup owns it. | med | — | — |
| 27 | Error-logging daemon errdemon_health — WARN | errdemon running; errlog capped at 8192 bytes (below the 1048576-byte default) | raise the errlog size as root: '/usr/lib/errdemon -s 1048576' (or larger); it takes effect immediately. | low | — | — |
| 28 | Error notification methods errnotify_methods — WARN | default errnotify only (diagela call-home present, no site paging) | add an errnotify ODM stanza (odmadd) whose en_method pages/mails on class=H PERM and disk labels (e.g. SC_DISK_ERR*, LVM_SA_QUORCLOSE). | low | — | — |
| 29 | Trusted Execution trusted_exec — WARN | TE=OFF | consider enabling TE ('trustchk -p TE=ON') if your change control supports it. | low | — | — |
| 30 | Login banner login_banner — WARN | no herald set | set a herald in the /etc/security/login.cfg default stanza (chsec -a herald=...). | low | — | — |
| 31 | Kernel tunables (nextboot) tunables — WARN | 1 changed tunable line(s) | review /etc/tunables/nextboot; record why each change exists, or revert to default. | low | — | — |
| 32 | Host self-resolution host_resolves — WARN | acme-prod-aix01 does not self-resolve locally — no matching /etc/hosts entry; resolution order not declared/readable | add acme-prod-aix01 to /etc/hosts with the system's intended local address. | low | — | — |
| 33 | Remote syslog remote_syslog — WARN | no remote target | add an '@loghost' line to /etc/syslog.conf and 'refresh -s syslogd'. | low | — | — |
| 34 | Performance history perf_history — WARN | none running | enable topas recording ('topasrec'/xmwlm) so history exists when you need it. | low | — | — |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| AIX release support | PASS | low | — | 7300-04-00-2546 — no announced end of support | This AIX release is in active support and still receives security fixes. Fix: n/a |
| Technology Level currency | PASS | low | — | 7300-04 (latest TL) | This Technology Level is current for its release. Fix: n/a |
| Firmware Update Access Key | PASS | low | — | valid through 2026-09-16 | The firmware Update Access Key is current — firmware released before its expiry date can be applied. Fix: n/a |
| AIX Update Access Key | NOT_APPLICABLE | low | — | n/a (Power10+ only) | The AIX Update Access Key is a Power10+ entitlement; this hardware/level does not report one. Fix: n/a |
| Hardware generation | WARN | med | — | 9008-22L (POWER9) — hardware support ended 2026-01-31 (fully-virtual LPAR) | This hardware generation is past IBM support, but this LPAR has no physical I/O adapters — the hardware is the host provider's to maintain (PowerVS or your VIOS estate). Confirm whose problem this is. Fix: confirm who owns the hardware (IBM on PowerVS; your team on-prem), then plan or request a host refresh to current-generation IBM Power11 hardware; the host change is outside this LPAR. |
| System firmware currency | WARN | high | — | VL950_168 — family FW950 current; hardware support ended 2026-01-31; firmware UAK valid through 2026-09-16 | The measured firmware lifecycle evidence has one or more currency constraints: family FW950 current; hardware support ended 2026-01-31; firmware UAK valid through 2026-09-16. Fix: review IBM FLRT/Fix Central for machine type 9008, renew a near-expiry UAK, and schedule the supported firmware/hardware path named above. |
| VIOS level currency | NOT_APPLICABLE | low | — | role=aix — /usr/ios/cli/ioscli absent (ls rc=2); ioslevel not applicable | The VIOS marker command positively proved this is a plain AIX LPAR, so a VIOS level does not apply. Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| Installed build age | PASS | low | — | built week 2546 (~8 months ago) | The installed build is reasonably current. Fix: n/a |
| Fileset consistency | PASS | low | — | 698 filesets, 0 broken | All installed filesets are in a consistent state. Fix: n/a |
| Fileset dependency consistency (lppchk -v) | PASS | low | — | consistent | 'lppchk -v' AND the independent 'lppchk -m3 -v' escalation both returned a genuinely confirmed clean result (rc=0, stdout and stderr both empty), and the fileset inventory itself (698 filesets) is a real, populated AIX system, not an empty/truncated capture. Fix: n/a |
| Update-time space preview (informational) | NOT_ASSESSED | low | — | not run this scan (requires a specific lpp_source) | This scan's own filesystem-fullness findings are a general steady-state signal, not the authoritative 'will the next update fit' answer. IBM's own preview-mode check against your ACTUAL lpp_source is the one that matters before an update — this tool has not run it and cannot run it as a general scan. Fix: before the next update, run 'smitty update_all' with 'PREVIEW only? = yes' (or 'installp -p -a -d <lpp_source> all|<filesets>') and review its 'Estimated system resource requirements' table (Needed vs Free per filesystem) — this is read-only/non-committing and is the real pre-flight check, distinct from this tool's own general df -g findings. |
| Interim fixes (ifixes) | PASS | low | — | none installed | No interim fixes — updates will not be blocked by leftover efixes. Fix: n/a |
| Tracked security APARs | NOT_ASSESSED | high | — | not assessed — no bundled security APAR rows apply to 7300-04 | Absence of a bundled row provides no evidence that the system has no CVE exposure. Fix: run current IBM flrtvc.ksh with a current apar.csv and pass the report via --flrtvc-report; review IBM PSIRT. |
| OpenSSH / OpenSSL levels | PASS | low | — | openssh 9.9.3015.2000, openssl 3.0.16.1000 | The OpenSSL 3.x line is current for AIX; keep both current via security bulletins. Fix: n/a |
| IBM SDK Java lifecycle | PASS | low | — | Java 8 installed (Java8_64.jre 8.0.0.851, Java8_64.sdk 8.0.0.851) | Java 8 is the last IBM SDK on AIX — track its service window (standard support ended 2025-04-30; extended runs to 2030-12-31 with an AIX SWMA contract). Fix: n/a |
| FLRT APAR exposure scan | NOT_ASSESSED | high | — | not assessed — no flrtvc.ksh invocation or report supplied | Full CVE/APAR exposure was NOT evaluated — the embedded security-APAR seed above covers only a small curated set, not IBM's own FLRTVC engine. Absence of a result must never read as clean. Fix: fetch apar.csv + flrtvc.ksh (tools/refresh-data.py) and re-run with --flrtvc-ksh + --flrtvc-apar-csv (preferred), or supply a pre-generated --flrtvc-report. |
| Reference data freshness | PASS | low | — | reference data 6 day(s) old | reference data 6 day(s) old — EOS dates, APARs and firmware levels reflect IBM data as of 2026-07-14. Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| Filesystem / | PASS | low | — | 35% used | Healthy free space. Fix: n/a |
| Filesystem /var | PASS | low | — | 48% used | Healthy free space. Fix: n/a |
| Filesystem /tmp | PASS | low | — | 2% used | Healthy free space. Fix: n/a |
| Other filesystems | FAIL | med | — | /opt 94%; repo (informational): /usr/sys/inst.images 100% | One or more non-system filesystems are critically full. Fix: free space or extend them; add monitoring. |
| Inode usage (JFS2) | PASS | low | — | no filesystem above 90% inodes | JFS2 inode usage has headroom on every filesystem. Fix: n/a |
| Paging space | PASS | low | — | 1 space(s), 3% used | Memory pressure is low. Fix: n/a |
| LV mirror sync | PASS | low | — | no stale partitions | All logical volume copies are in sync. Fix: n/a |
| Volume group disks | PASS | low | — | all PVs active | Every volume group disk is present and active. Fix: n/a |
| Boot logical volume (hd5) size | PASS | low | — | 64MB (2 LP x 32MB), contiguous on hdisk0 | hd5 meets IBM's current 64MB boot-image sizing guidance and its physical partitions are contiguous on disk (every copy checked: hdisk0). Fix: n/a |
| multibos/alt_disk standby-BOS residue | PASS | low | — | none | No leftover multibos standby-BOS state (bos_-prefixed LVs or a mounted /bos_inst). Fix: n/a |
| Volume group free space | PASS | low | — | worst: rootvg 8% free | Every online volume group has room to extend a filesystem. Fix: n/a |
| MPIO path health | PASS | low | — | 8 paths / 1 disks, all enabled | Full path redundancy. Fix: n/a |
| MPIO health-check probing | PASS | low | — | MPIO disks=1; showing 1 of 1; applicable=1; attribute not applicable=0; unreadable=0; table: disk interval mode | hdisk0 60 nonactive | Every applicable multipath disk reports a nonzero health-check interval no greater than 300 seconds. Fix: n/a |
| Fibre Channel adapter errors | NOT_ASSESSED | low | — | fcs0: counters not reported (virtual FC); fcs1: counters not reported (virtual FC); fcs2: counters not reported (virtual FC); fcs3: counters not reported (virtual FC) | Virtual FC adapters do not expose error counters inside the LPAR, so CRC/link-failure health could not be observed from here at all — this is not evidence of a clean adapter, just an architectural blind spot. Check path health on the VIOS side. Fix: n/a |
| Volume group geometry | PASS | low | — | rootvg 32MB PP, 639 PP/disk | Physical-partition geometry is sane on every online VG — the PP size fits the VG size, so the allocation map is neither bloated (tiny PP) nor wasteful (huge PP). Fix: n/a |
| LV mirror placement | PASS | low | — | no mirrored LVs | No logical volume is mirrored in-LPAR — single-copy LVs here rely on the SAN/VIOS for redundancy (in-LPAR mirroring is separate and not configured). Fix: n/a |
| Filesystem vs LV sizing | PASS | low | — | no filesystem lags its LV by 512MB+ | Every JFS2 filesystem is grown into the logical volume it sits on — no allocated-but-unusable slack between the LV and the filesystem. Fix: n/a |
| Legacy JFS filesystems | PASS | low | — | all filesystems are JFS2 | No legacy JFS filesystems — everything is JFS2, the current AIX filesystem. Fix: n/a |
| Mount options | PASS | low | — | /tmp separate; 9 jfs2 mount(s), all logged; 9 using default atime | Mount hygiene is sound: /tmp is its own filesystem and every JFS2 mount has a log. Performance options (noatime for read-heavy mounts, cio/dio for databases, rbrw) are workload-specific and left to the app owner — atime-on is the AIX default and fine unless a mount is known read-heavy. Fix: n/a |
| Paging space parity | PASS | med | — | single paging space defined; multi-space parity not applicable | Only one paging space is defined, so there is no second space whose size or active state could be out of parity. Fix: n/a |
| Paging space layout | PASS | low | — | 1 paging space(s), no single-disk contention Total paging 512MB vs 4096MB RAM. | Paging-space placement is fine — no two paging spaces share a disk, and there is no cross-VG contention to relieve. (Utilisation is checked separately under Paging space.) Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| LPAR CPU entitlement | PASS | low | — | shared Uncapped, ent 0.25, physc 0.02 (9.4% entc), 1 VP SMT-8, idle 99.2% | Shared-pool CPU entitlement looks reasonable for this sample: consuming 9.4% of the 0.25-core guarantee, uncapped so it can burst. A small entitlement plus uncapped is efficient design. Snapshot, not a trend. Fix: n/a |
| Memory composition | PASS | low | — | computational 67%, file/numperm 12%, 1218MB avail (29%) | Memory has headroom: 67% computational, 1218MB available; no composition red flags in this snapshot. Fix: n/a |
| VMM cache tuning | PASS | low | — | minperm 3% / maxperm 90% / maxclient 90% (AIX defaults); numperm 12.6% | VMM cache tuning is at AIX defaults and the file cache is not pinned at its ceiling. Fix: n/a |
| JFS2 filesystem-buffer blocking | WARN | med | — | blocked since boot: jfs2 fsbuf 1656, external-pager 370, client 0 | Filesystem I/O has been blocked waiting for JFS2 filesystem buffers (fsbuf) 2026 time(s) since boot — the buffer pool ran dry under I/O load and requests had to wait, adding latency that CPU/memory graphs never reveal. The count is cumulative since boot. Fix: re-read 'vmstat -v' after a busy period: if the number is still climbing, raise JFS2 buffers with 'ioo -p -o j2_dynamicBufferPreallocation=<n>' (default 16, in 16KB units) and/or 'ioo -p -o numfsbufs=<n>'; a static non-zero count from a past burst is usually benign. |
| LVM/paging buffer blocking | PASS | low | — | 0 pbuf and 0 psbuf blocks | No LVM pbuf or paging psbuf starvation since boot — buffer pools have kept up with disk and paging I/O. Fix: n/a |
| I/O pacing (maxpout/minpout) | PASS | low | — | maxpout=8193, minpout=4096 (paced) | System-wide I/O pacing is configured, so a runaway writer cannot monopolize a disk and starve interactive I/O. Fix: n/a |
| CPU headroom (snapshot) | PASS | low | — | idle 92%, physc 0.07, run queue r=1 vs 8 logical CPUs | CPU has headroom in this sample: idle 92% with a short run queue for 8 logical CPUs (point-in-time snapshot, not a trend). Fix: n/a |
| Paging activity (snapshot) | PASS | low | — | pi=0, po=0 in this sample | No active paging in this sample — memory demand is being met from RAM (this is the activity read; paging-space capacity is checked separately under storage). Fix: n/a |
| Adapter health | PASS | low | — | en0 20000Mb(virt) 0err; en1 20000Mb(virt) 0err | All ethernet interfaces are up with zero transmit/receive/CRC/buffer errors (counters cumulative since boot). Fix: n/a |
| Process limits (maxuproc) | PASS | low | — | busiest user 'root' 42 procs vs maxuproc 128 (32%) | Per-user process headroom is fine — the busiest user is well under the maxuproc fork ceiling. Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| Error log (7 days) | FAIL | high | — | 26 error entries (9 informational ignored) (recurring E18E984F x21) | A noisy error log — something is actively wrong or flapping. Fix: triage 'errpt' now, most recent and most frequent first. |
| Permanent hardware errors (30 days) | PASS | high | — | none | No permanent hardware errors logged. Fix: n/a |
| System dump device | PASS | low | — | primary: /dev/lg_dumplv | A panic here can be diagnosed. Fix: n/a |
| Recent crash evidence | PASS | low | — | none in 30 days | No recent crash dumps found. Fix: n/a |
| Error-logging daemon | WARN | low | — | errdemon running; errlog capped at 8192 bytes (below the 1048576-byte default) | The error daemon is up, but the circular error log is capped below the 1 MB default — on a chatty box the oldest entries roll off sooner, so a fault that logged a few days ago may already be gone when you look. Fix: raise the errlog size as root: '/usr/lib/errdemon -s 1048576' (or larger); it takes effect immediately. |
| Decoded error labels | PASS | low | — | 26 non-informational error(s); most frequent: SRC x21; none match a known-critical label | There are non-informational errors, but none decode to a known-critical hardware or LVM label — most are software or operator events. (Counts and triage are under 'Error log' above; this check is the label decode.) Fix: n/a |
| Pre-failure signatures | PASS | high | — | none in 7 days | None of the classic pre-failure patterns a veteran hunts for — disk/adapter errors, SAN/SCSI path faults, EPOW power or thermal events, memory ECC errors, LVM disk loss, or dump-device faults — appear in the error log for the last 7 days. Fix: n/a |
| Error notification methods | WARN | low | — | default errnotify only (diagela call-home present, no site paging) | The default diagela stanzas forward hardware errors to the diagnostics / Service Focal Point path (call-home, if enabled on the HMC/service processor), but no stanza runs a site alert script — nothing pages or mails your on-call on a critical or disk error. Fix: add an errnotify ODM stanza (odmadd) whose en_method pages/mails on class=H PERM and disk labels (e.g. SC_DISK_ERR*, LVM_SA_QUORCLOSE). |
| System dump history | PASS | low | — | no system dump ever recorded | The dump device has never captured a dump — expected on a box that has not panicked. It does mean the dump path is configured but unproven; only a real dump proves it works. (Whether a device is configured at all is checked separately under 'System dump device'.) Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| OS backup (mksysb) evidence | FAIL | high | — | /image.data older than 90 days | No recent OS backup evidence on this box — a rootvg loss means rebuild-from-scratch. (Local evidence only; confirm where mksysb lands and when it last ran.) Fix: run a mksysb now; schedule it; verify the target is itself backed up. |
| rootvg redundancy | WARN | high | — | 1 disk, unmirrored | The OS lives on one disk — a single point of failure unless the backing storage is RAID/SAN-protected. Verify which. Fix: mirror rootvg (mirrorvg + bosboot + bootlist) or document the storage-level protection. |
| Alternate rootvg clone | WARN | high | — | status=NOT_APPLICABLE; usable=null; volume_group=null; disks=[]; reason=lspv reported no altinst_rootvg or old_rootvg; source_commands=[lspv] | No alternate rootvg clone is configured, so this system has no measured fast-rollback path. Fix: create and regularly refresh an alt_disk_copy clone of rootvg on a platform-bootable alternate disk; verify it with alt_rootvg_op and bootlist. |
| Dump device sizing | PASS | low | — | device 4096 MB covers estimated dump 1359 MB | The primary dump device (lg_dumplv, 4096 MB) is comfortably larger than the estimated dump for this LPAR (1359 MB), so a panic can capture a complete image. Re-check 'sysdumpdev -e' after any memory increase — the estimate tracks RAM. Fix: n/a |
| Dump copy directory | WARN | med | — | copy dir /var/adm/ras has 215 MB free, estimated dump 1359 MB | The dump device can capture the dump, but the copy directory (/var/adm/ras, 215 MB free) is too small to hold a dump of the estimated size (1359 MB). On reboot the copy off the device fails, so the image is lost before anyone can analyze it — the same forensic loss as an undersized device, one step later. Fix: free space in /var/adm/ras or point the copy directory at a filesystem with room for the dump ('sysdumpdev -D <dir>'), sized to 'sysdumpdev -e'. |
| Boot image currency | PASS | low | — | booted Jul 12, after kernel bos.mp64 install 11/21/25 | The system last booted AFTER the running kernel (bos.mp64) was installed, so the running kernel matches what is on disk and no kernel-update reboot is outstanding. (AIXray is read-only: it cannot inspect the hd5 boot image directly, so this compares the kernel install date to the last boot as a proxy for boot-image currency.) Fix: n/a |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| SSH ciphers | PASS | high | — | aes128-ctr,aes192-ctr,aes256-ctr,chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com | sshd offers only strong ciphers. Fix: n/a |
| SSH root login | FAIL | high | — | permitrootlogin yes | Direct SSH root login is open — a single brute-forceable credential with no accountability. Fix: set 'PermitRootLogin no' (or prohibit-password) in sshd_config and restart sshd. |
| Default password policy | WARN | high | — | weak: loginretries=0 | The default password rules are weaker than any standard requires — every new account inherits them. Fix: tighten the /etc/security/user default stanza (maxage 1-13wk, minlen>=8, loginretries>0, histsize>0). |
| Password hashing algorithm | PASS | high | 5.2.8 PASS | ssha256 | The configured password hashing algorithm avoids the legacy DES crypt default and its 8-character password limit. Fix: n/a |
| UID 0 accounts | PASS | med | — | root only | root is the only UID 0 account. Fix: n/a |
| Failed login attempts | WARN | med | — | 16539 recorded (lifetime total) | A high lifetime total of failed logins — someone has been knocking, whether a misconfigured app or a brute-force attempt. This log is never auto-trimmed, so review recency, not just the count. Fix: review recency ('who /etc/security/failedlogin | tail') and rotate the log; lock or investigate the source accounts/hosts. |
| Cleartext inetd services | PASS | med | — | none enabled | No cleartext remote-access services are enabled in inetd. Fix: n/a |
| Trust files (.rhosts) | FAIL | high | — | present: /.rhosts | Host-trust files allow passwordless login from named hosts — a classic lateral-movement path. Fix: remove /.rhosts and /etc/hosts.equiv; rely on key-based ssh instead. |
| World-writable files | PASS | low | — | none in /etc, /usr/local/bin | No world-writable files in the scanned directories (scope bounded to /etc and /usr/local/bin). Fix: n/a |
| SNMP community strings | FAIL | med | — | default community in use | SNMP uses a default community string (public/private) — anyone on the network can read, or write, system data. Fix: replace public/private with a strong community in /etc/snmpd.conf and refresh snmpd. |
| Audit subsystem | WARN | high | — | auditing off | No audit trail — you cannot answer 'who did what' after an incident. Fix: configure and start audit ('audit start'; set it to start at boot). |
| Trusted Execution | WARN | low | — | TE=OFF | Trusted Execution is off (informational) — no runtime binary-integrity enforcement. Fix: consider enabling TE ('trustchk -p TE=ON') if your change control supports it. |
| Login banner | WARN | low | — | no herald set | No legal login banner is set — auditors ask for one and it deters casual access. Fix: set a herald in the /etc/security/login.cfg default stanza (chsec -a herald=...). |
| Account password aging | PASS | low | — | no non-system account with maxage=0 (1 locked) | Every non-system account has password aging set. Fix: n/a |
| Unexpected setuid/setgid files | PASS | low | — | none in /home /tmp /var/tmp /usr/local | No setuid/setgid files outside the system paths. Fix: n/a |
| Listening network sockets | PASS | low | — | 12 listening socket(s) | Each listening socket is attack surface — review anything you do not recognize. Fix: n/a |
| root account controls | FAIL | high | — | rlogin=true + sugroups=ALL (root wide open) | root can log in directly over the network (rlogin=true) AND any user may attempt su to root (sugroups=ALL) — the classic 'root wide open' pair. Either alone is a gap; together, root is one guessed password away from a network login with no accountability. This is the OS account gate in /etc/security/user, separate from sshd's PermitRootLogin. Fix: restrict both: 'chsec -f /etc/security/user -s root -a rlogin=false' (admins log in as themselves and su/sudo to root) and '-a sugroups=<sysadmin-group>' so only a named group may su to root. |
| Stale privileged accounts | PASS | low | — | 1 privileged account(s), none stale | Every privileged account has been used within 90 days (or is locked); no dormant standing-privilege accounts with non-expiring passwords. Fix: n/a |
| Privilege delegation (sudo/RBAC) | NOT_ASSESSED | med | — | not assessed — lslpp sudo capture failed (rc=1) | Privilege delegation could not be assessed because the sudo package, sudoers file list, or active-rule capture failed, was empty, or was unparseable. Fix: verify sudo installation and inspect every active sudoers file with visudo before treating delegation as scoped. |
| Network exposure vs filtering | WARN | med | — | 12 external listener(s) on ports 22,25,111,199,657,1334,2049,32768 +3 more; host IP filtering INACTIVE | 12 services listen on non-loopback addresses (reachable from the network) and AIX host packet filtering (IP Security) is not active — the box relies entirely on the upstream network/firewall. One perimeter mistake, VLAN change, or misrouted subnet exposes every one of these ports directly. Fix: reduce the surface first (stop services you do not need — see the listeners and cleartext-inetd checks), then, if the box must self-defend, define rules with 'genfilt'/'mkfilt' and activate host filtering with 'mkfilt -v4 -u'. |
| STIG file permissions | FAIL | high | 4.1.1.3 FAIL 4.1.1.2 PASS | 7 of 11 rules compliant, 0 not applicable; failing: V-215269 /etc/inetd.conf (0664), V-215281 /etc/ntp.conf (0664), V-245559 /etc/hosts (0664), V-245563 /etc/syslog.conf (0644) | One or more files mandated by the DISA STIG for IBM AIX 7.x are more permissive, or wrong-owned, than the rule allows — each is a documented hardening gap an auditor will flag. Fix: chmod/chown the failing files to the required mode/owner per the rule list (chmod <maxmode> <path>; chown <owner>:<group> <path>); the compliance report lists every rule and its evidence. |
| STIG account policy | FAIL | high | — | 5 of 12 rules compliant, 1 n/a; failing: V-215171 loginretries=0 (needs le 3), V-215220 mindiff=0 (needs ge 8), V-215223 maxage=13 (needs le 8), V-215224 histsize=4 (needs ge 5), V-215226 minlen=10 (needs ge 15), +2 more | One or more account/password-policy attributes in /etc/security are weaker than the DISA STIG for IBM AIX 7.x mandates — each is a documented hardening gap an auditor will flag, and it applies to every account inheriting the default stanza. Fix: tighten the failing attributes with chsec (chsec -f <file> -s default -a <attr>=<value>); the compliance report lists every rule, the required value, and the observed value. |
| STIG network tunables | FAIL | high | 4.5.6 PASS 4.5.7 PASS 4.5.3 FAIL 4.5.2 PASS | 3 of 4 rules compliant, 0 n/a; failing: V-215399 clean_partial_conns=0 (needs eq 1) | One or more kernel network options are set to a value the DISA STIG for IBM AIX 7.x flags — e.g. IP forwarding on a non-router, or TCP half-open connection cleanup disabled. Each is a documented hardening gap an auditor will flag. Fix: set the failing tunables with 'no -p -o <tunable>=<value>' (nfso for NFS options) so the change persists across reboot; the compliance report lists every rule, the required value, and the observed value. |
| STIG disabled services | FAIL | high | — | 34 of 37 rules compliant, 0 n/a; failing: V-215353 sendmail, V-215354 snmpd, V-215365 snmpmibd | One or more legacy network services the DISA STIG for IBM AIX 7.x requires disabled are still enabled or running — each is an unneeded, often unauthenticated, network-facing daemon an auditor will flag. Fix: comment the service out of /etc/inetd.conf and 'refresh -s inetd' (inetd services), or 'stopsrc -s <subsystem>' and disable it at boot (SRC subsystems); the compliance report lists every rule and its evidence. |
| NFS exports | WARN | med | 4.4.1.6 PASS | exportfs: nothing exported | One or more exports are writable by default and have no access= client restriction, so any client that can reach the NFS service can attempt to mount them. Fix: add an explicit access= host list and use ro unless the clients genuinely require writes; re-export only through the normal approved change process. |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| Time synchronization (NTP) | FAIL | med | — | xntpd inoperative, 0 server(s) | No working time sync — clock drift breaks log correlation, Kerberos and TLS. Fix: configure /etc/ntp.conf with a server and start xntpd ('startsrc -s xntpd'; enable at boot). |
| DNS resolver | PASS | low | — | 1 nameserver(s) | At least one DNS resolver is configured. Fix: n/a |
| Default route | PASS | low | — | default route present | A default route is configured. Fix: n/a |
| Kernel tunables (nextboot) | WARN | low | — | 1 changed tunable line(s) | Kernel tunables are changed from default for next boot — deliberate tuning or archaeology? document each. Fix: review /etc/tunables/nextboot; record why each change exists, or revert to default. |
| Timezone (TZ) | PASS | low | — | TZ=EST5EDT | The system timezone is set explicitly. Fix: n/a |
| Host self-resolution | WARN | low | — | acme-prod-aix01 does not self-resolve locally — no matching /etc/hosts entry; resolution order not declared/readable | Tools and certs can misbehave when the box has no local entry for its own hostname; AIXray deliberately did not query DNS. Fix: add acme-prod-aix01 to /etc/hosts with the system's intended local address. |
| Check | Status | Sev | CIS L1 check | Observed | What it means & how to fix |
|---|---|---|---|---|---|
| Monitoring agent | WARN | high | — | no KNOWN monitoring agent detected (checked: Zabbix agent, Nagios NRPE, Prometheus node_exporter, IBM Tivoli/ITM kuxagent, collectd, njmon/nimon, Datadog agent) | AIXray checked only the listed known agents and found none; other monitoring may still be present. Fix: confirm monitoring coverage; if none exists, install and point a monitoring agent at this LPAR. |
| Error notification | WARN | med | — | 26 errnotify stanzas (defaults only) | Errors log locally and tell no one — the error log only helps if someone happens to read it. Fix: add an errnotify ODM stanza that emails or pages on PERM hardware and disk errors. |
| Remote syslog | WARN | low | — | no remote target | No remote syslog target — logs die with the box, exactly when you need them. Fix: add an '@loghost' line to /etc/syslog.conf and 'refresh -s syslogd'. |
| Performance history | WARN | low | — | none running | No performance-history collection — sizing and incident forensics become guesswork. Fix: enable topas recording ('topasrec'/xmwlm) so history exists when you need it. |
| Scheduled backup job | WARN | med | — | no backup in crontab | No scheduled backup in root's crontab — where does the mksysb come from? Fix: schedule mksysb/savevg in root's crontab, or confirm NIM/central backup owns it. |