The rusersd daemon must be disabled on AIX.

The rusersd service runs as root and provides a list of current users active on a system. An attacker may use this service to learn valid account names on the system. This is not an essential service and should be disabled.

From the command prompt, execute the following command: # grep "^rusersd[[:blank:]]" /etc/inetd.conf

If there is any output from the command, this is a finding.

In "/etc/inetd.conf", comment out the "rusersd" entry by running command: # chsubserver -r inetd -C /etc/inetd.conf -d -v 'rusersd' -p 'udp'

Restart inetd: # refresh -s inetd