10.1 SN.1 Restrict access to suspend feature

Information

Solaris 11 does not enable the suspend capability by default and now uses the poweradm command to suspend the system.

Rationale:

Bear in mind that users with physical access to a system can simply remove power from the machine if they are truly motivated to take the system off-line, and granting the capability to use poweradm may be a more graceful way of allowing desktop users to shut down their own machines.

Solution

Perform the following to implement the recommended state:

# poweradm set suspend-enable=false

# poweradm update

See Also

https://workbench.cisecurity.org/benchmarks/4777

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1

Plugin: Unix

Control ID: e65f2bfa1eabfa0b28be2cef94d7c9d4f70cae292802dc910c410278b2f8df48