How to use viosecure to tunning vios

viosecure command can be a problem if you apply the high level of hardening on a system.
If you wish you can apply only a set of values on your environment.
First thing that you need to do is get the file /etc/security/aixpert/core/viosecureall.xml
Check the xml file and you can see that on the file you will have all the set of harderning rules for high, medium and low.
If you decide to apply the high, be in mind that certain things can stop working.
So to easy things you can starting apply only some set of rules that you consider important.

Below is the content of a customized file that you can start using to apply the minim history size for example:

<?xml version="1.0" encoding="UTF-8"?>
<!--     @(#)45    1.2.1.12  src/bos/usr/lib/security/aixpert/scripts/viosecureall.xml, aixpert, bos72Q, q2019_31A8 7/30/19 10:35:04   

    COMPONENT_NAME:   (AIXPERT) aixpertall.xml

    FUNCTIONS:

    ORIGINS: 27                -->


<!--    RuleType HLS represents High Level Security Rules

    RuleType MLS represents Medium Level Security Rules

    Ruletype LLS represents Low Level Security Rules

    RuleType DLS represents Default Level Security Rules

    RuleType Prereq represents Analysis Rules

    RuleType SCBPS represents SOX-COBIT Rules

    Rulenames begin with hls for High Level Security rules

    Rulenames begin with mls for Medium Level Security rules

    Rulenames begin with lls for Low Level Security rules

    Rulenames begin with dls for Default Level Security rules

    Rulenames begin with scbps for SOX-COBIT rules  -->

<!--    Please do not Translate the contents of <AIXPertGroup> tag.
        Only <AIXPertDescription> tag contents should be translated. -->

<!-- Specifies all AIXpert rules for HLS, MLS, LLS, DLS and SCBPS -->

<AIXPertSecurityHardening>
 <AIXPertEntry name="hls_histsize" function="histsize">
    <AIXPertRuleType type="HLS"/>
    <AIXPertDescription>Password reuse time: Specifies the number of previous passwords a user cannot resuse to 20</AIXPertDescription>
    <AIXPertPrereqList>bos.rte.date,bos.rte.commands,bos.rte.security,bos.rte.shell,bos.rte.ILS</AIXPertPrereqList>
    <AIXPertCommand>/etc/security/aixpert/bin/chusrattr</AIXPertCommand>
    <AIXPertArgs>histsize=20 ALL hls_histsize</AIXPertArgs>
    <AIXPertGroup>Password policy rules</AIXPertGroup>
  </AIXPertEntry>
</AIXPertSecurityHardening>

Save the content of the file on:

/etc/security/aixpert/custom/hls_histsize.xml


On the vios check if the rule is set:

/usr/ios/cli/ioscli viosecure -view -rule hls_histsize

# /usr/ios/cli/ioscli viosecure -view -rule hls_histsize
Security rules are not applied on the system.

On my case you can see that the rule is not applied yet.

Apply the rule from the file that you have created:

/usr/ios/cli/ioscli viosecure -file  /etc/security/aixpert/custom/hls_histsize.xml


Check again:

# /usr/ios/cli/ioscli viosecure -view -rule hls_histsize
hls_histsize_59411A9E:Password reuse time: Specifies the number of previous passwords a user cannot resuse to 20



Now the rule is applied.
You can add more rules if you wish on the file.
Be careful with the format of the file.

If you need undo configurations or more examples, check the man page for vio secure.

You can check for example rules changed:

/usr/ios/cli/ioscli viosecure -changedRules



Following the how to above will be much more easy for you apply the rules on the entire system to put it on compliance.