{"stig":{"title":"IBM z/OS RACF Security Technical Implementation Guide","version":"9","release":"8"},"checks":[{"vulnId":"V-223646","ruleId":"SV-223646r958482_rule","severity":"medium","ruleTitle":"Certificate Name Filtering must be implemented with appropriate authorization and documentation.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\nAccesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\nAccesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"Currently the RACDCERT command does not support a generic userid value of ID(*) LISTMAP to list all the certificate name filters defined to RACF. However, the following commands can be issued to determine if certificate name filtering may be implemented.\n\nIf certificate name filtering is in use, collect documentation describing each active filter rule and written approval from the ISSM to use the rule.\n\nIssue the SETROPTS LIST command. If the DIGTNMAP resource class is active, RACF is ready to process any certificate name filters with a Status of TRUST. The DIGTNMAP resource class should not be active unless certificate name filtering is desired.\n\nIf the DIGTNMAP resource class is not active, this is not a finding.\n\nCertificate name filters are stored as profiles in the DIGTNMAP resource class. The RLIST command is not intended for use with profiles in the DIGTNMAP resource class. However it can be used to determine if any profiles are defined. (NOTE: The information will not be displayed in a suitable format to easily interpret the filter.) \n\nRLIST DIGTNMAP *\n\nIf there is nothing to list in the DIGTNMAP resource class, this is not a finding.\n\nIf profile information is displayed, one or more certificate name filters are defined to RACF. Under the NAME heading of each profile listing is the userid the filter is being mapped to. Issue the following command the list the certificate name filter associated with each userid:\n\nRACDCERT ID(profile name userid) LISTMAP\n\nNOTE: Certificate name filters are only valid when their Status is TRUST. Therefore, you may ignore filters with the NOTRUST status.\n\nIf the DIGTNMAP resource class is active and certificate name filters have a Status of TRUST, certificate name filtering is in use.\n\nIf certificate name filtering is in use and filtering rules have been documented and approved by the ISSM, this is not a finding.\n\nIf certificate name filtering is in use and filtering rules have not been documented and approved by the ISSM, this is a finding.","fixText":"Ensure any certificate name filtering rules in use are documented and approved by the ISSM.","ccis":["CCI-000764"]},{"vulnId":"V-223647","ruleId":"SV-223647r958448_rule","severity":"medium","ruleTitle":"Expired digital certificates must not be used.","description":"The longer and more often a key is used, the more susceptible it is to loss or discovery. This weakens the assurance provided to a relying Party that the unique binding between a key and its named subscriber is valid. Therefore, it is important that certificates are periodically refreshed. This is in accordance with DoD requirement. Expired Certificate must not be in use.","checkContent":"From the ISPF Command Shell enter:\nRACDCERT CERTAUTH LIST\n\nIf no certificate information is found, this is not a finding.\n\nNOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following check.\n\nCheck the expiration (End Date) for each certificate with a status of TRUST.\n\nIf the expiration date has passed, this is a finding.","fixText":"If the certificate is a user or device certificate with a status of TRUST, follow procedures to obtain a new certificate or re-key certificate. If it is an expired CA certificate remove it.","ccis":["CCI-000185"]},{"vulnId":"V-223648","ruleId":"SV-223648r998341_rule","severity":"medium","ruleTitle":"All digital certificates in use must have a valid path to a trusted certification authority (CA).","description":"The origin of a certificate, or the CA, is crucial in determining if the certificate should be trusted. An approved CA establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.\n\nSatisfies: SRG-OS-000066-GPOS-00034, SRG-OS-000403-GPOS-00182","checkContent":"From the ISPF Command Shell enter:\nRACDCERT CERT AUTH\n\nIf no certificate information is found, this is not a finding.\n\nNOTE: Certificates are only valid when their Status is TRUST. Therefore, you may ignore certificates with the NOTRUST status during the following check.\n\nIf the digital certificate information indicates that the issuer's distinguished name leads to one of the following, this is not a finding:\na) A DOD PKI Root Certification Authority\nb) An External Root Certification Authority (ECA)\nc) An approved External Partner PKI's Root Certification Authority\n\nThe DOD Cyber Exchange website contains information as to which certificates maybe acceptable (https://public.cyber.mil/pki-pke/interoperability/ or https://cyber.mil/pki-pke/interoperability/).\n\nExamples of an acceptable DOD CA are:\nDOD PKI Class 3 Root CA\nDOD PKI Med Root CA","fixText":"Remove and/or replace certificates with a status of TRUST whose issuer's distinguished name does not lead to a DOD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI's Root Certification Authority.\n\nReference the DOD Cyber Exchange website for complete information as to which certificates may be acceptable (https://public.cyber.mil/pki-pke/interoperability/ or https://cyber.mil/pki-pke/interoperability/).","ccis":["CCI-000185","CCI-002470","CCI-004909"]},{"vulnId":"V-223649","ruleId":"SV-223649r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to SYS1.NUCLEUS to system programmers only.","description":"This data set contains a large portion of the system initialization (IPL) programs and pointers to the master and alternate master catalog. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Execute a dataset access list for SYS1.NUCLEUS.\n\nIf all of the Following are untrue, this is not a finding.\n\nIf any of the following is true, this is a finding.\n\n-The ACP data set rules for SYS1.NUCLEUS do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ACP data set rules for SYS1.NUCLEUS do not specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect SYS1.NUCLEUS.\n\nConfigure the WRITE or greater access to SYS1.NUCLEUS to be limited to system programmers only and all WRITE or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223650","ruleId":"SV-223650r1137691_rule","severity":"low","ruleTitle":"IBM RACF must limit Write or greater access to libraries that contain PPT modules to system programmers only.","description":"Specific PPT designated program modules possess significant security bypass capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Review program entries in the IBM Program Properties Table (PPT). You may use a third-party product to examine these entries however, to determine program entries issue the following command from an ISPF command line:\nTSO ISRDDN LOAD IEFSDPPT\nPress Enter.\n\nFor each module identified in the \"eyecatcher\" if all of the following are untrue, this is not a finding.\n\nIf any of the following is true, this is a finding.\n\n-The ACP data set rules for libraries that contain PPT modules do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ACP data set rules for libraries that contain PPT modules do not specify that all WRITE or greater access will be logged.","fixText":"Configure the WRITE or greater access to libraries containing PPT modules to be limited to system programmers only and all WRITE or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223652","ruleId":"SV-223652r958508_rule","severity":"medium","ruleTitle":"IBM RACF emergency USERIDs must be properly defined.","description":"Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. \n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.","checkContent":"Ask the system administrator for a list of all emergency userids available to the site along with the associated function of each userid.\nIf there are no emergency logonids defined ask the system administrator for an alternate documented procedure to handle emergencies. \n\nIf there are no emergency logonids and no documented emergency procedure this is a finding.\n\nExecute an access list for each emergency userid.\n\nIf emergency userids exist at a minimum an emergency logonid will exist with the security administration attributes specified in accordance with the following requirements. \n\nIf the following guidance is not true, this is a finding.\n\nAt least one userid exists to perform RACF security administration. These userids are defined to RACF with the system-SPECIAL attribute. They must not have the OPERATIONS attribute.\n\nIf any userids exist to perform operating system functions, they are defined without any RACF security administration privileges. These userids are defined to RACF with the system-OPERATIONS attribute, and FULL access to all DASD volumes. They must not have the SPECIAL attribute.\n\nNOTE: A user who has the system-OPERATIONS attribute has FULL access authorization to all RACF-protected resources in the DASDVOL/GDASDVOL resource classes. However, if their userid or any associated group (i.e., default or connect) is in the access list of a resource profile, they will only have the access specified in the access list.\n\nAll emergency userids are defined to RACF and SYS1.UADS.\n\nAll emergency logonid/logonid(s) are to be implemented with logging to provide an audit trail of their activities. This is accomplished with the UAUDIT attribute.\n\nAll emergency logonid/logonid(s) will have distinct, different passwords in SYS1.UADS and in RACF, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in RACF.\n\nAll emergency logonid/logonid(s) will have documented procedures to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the ISSO. When an emergency logonid is released for use, its password is to be reset by the ISSO within 12 hours.","fixText":"Configure emergency USERIDs to have access granted only authorizes those resources required to support the specific functions of either DASD Recovery or System Administration. \n\nEnsure the following items are in effect regarding emergency userids:\n\nAt a minimum an emergency userids will exists with the security administration attributes specified in accordance with the following requirements:\n\n- Userids exist to perform RACF security administration only. These userids are defined to RACF with the system-SPECIAL attribute. They must not have the OPERATIONS attribute. Emergency userids will have either SPECIAL or OPERATIONS but not both.\n\n- Userids can be defined to perform operating system functions. Such userids must be defined without any RACF security administration privileges. These userids are defined to RACF with the system-OPERATIONS attribute, FULL access to all DASD volumes resources as well as the FACILITY Class STGADMN profiles. They must not have the SPECIAL attribute.\n\nNOTE: A user who has the system-OPERATIONS attribute has FULL access authorization to all RACF-protected resources in the DASDVOL/GDASDVOL resource classes. However, if their userid or any associated group (i.e., default or connect) is in the access list of a resource profile, they will only have the access specified in the access list since access lists override OPERATIONS.\n\n- Userids exist to perform RACF security administration only. These userids are defined to RACF with the system-SPECIAL attribute. They must not have the OPERATIONS attribute. Emergency userids will have either SPECIAL or OPERATIONS but not both.\n\n- All emergency userids are defined to RACF and SYS1.UADS. See TSO Command Ref for info on adding users to UADS.\n\n- All emergency userids are to be implemented with logging to provide an audit trail of their activities. This is accomplished with the UAUDIT attribute via the command:\n\nALU <uid> UAUDIT\n\n- All emergency userids will have distinct, different passwords in SYS1.UADS and in RACF, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in RACF.\n\n- All emergency userids will have documented procedures - such as a COOP Plan - to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the ISSO. When an emergency userids is released for use, its password is to be reset by the ISSO within 12 hours.   \n\nIf no emergency userids are in use on the system develop and document a procedure to manage emergencies access to the system.","ccis":["CCI-001682"]},{"vulnId":"V-223653","ruleId":"SV-223653r958368_rule","severity":"medium","ruleTitle":"IBM RACF SETROPTS LOGOPTIONS must be properly configured.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an account. Auditing account creation actions provides logging that can be used for forensic purposes.\n\nTo address access requirements, many operating systems may be integrated with enterprise level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. \n\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222","checkContent":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nVerify that the following LOGOPTIONS are specified:\nLOGOPTIONS \"FAILURES\" CLASSES = <all the classes listed in the \"ACTIVE\" class as a minimum>\nLOGOPTIONS \"NEVER\" CLASSES = NONE\n\nThe other LOGOPTIONS may be site determined.\n\nIf the LOGOPTIONS are not set as described above, this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nEnsure that the following LOGOPTIONS are specified:\nLOGOPTIONS \"FAILURES\" CLASSES = <all the classes listed in the \"ACTIVE\" class as a minimum>\nLOGOPTIONS \"NEVER\" CLASSES = NONE\n\nThe other LOGOPTIONS may be site determined.","ccis":["CCI-000018","CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-000135","CCI-000172","CCI-001404","CCI-001405","CCI-002884"]},{"vulnId":"V-223654","ruleId":"SV-223654r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must protect memory and privileged program dumps in accordance with proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"Execute a resource access list for the IEAABD. resources.\n\nIf the IEAABD. resource and/or generic equivalent is defined with no access and all access logged, this is not a finding.\n\nIf the IEAABD.DMPAUTH. resource and/or generic equivalent is defined with READ access limited to authorized users, this is not a finding.\n\nIf the IEAABD.DMPAUTH. resource and/or generic equivalent WRITE or greater access is restricted to only systems personnel and all access is logged, this is not a finding.\n\nIf the IEAABD.DMPAKEY resource and/or generic equivalent is defined and all access is restricted to systems personnel and that all access is logged, this is not a finding.","fixText":"Memory and privileged program dump resources are provided via resources in the FACILITY resource class. Configure these resources to the ESM as specified in the following. \n\n(Note: The resources and/or resource prefixes identified below are examples of a possible installation. The actual resources and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nBelow is listed the access requirements for memory and privileged program dump resources. Ensure the guidelines for the resource type, resources, and/or generic equivalent are followed. When protecting the facilities for dumps lists via the FACILITY resource class, ensure that the following items are in effect:\n\nIEAABD.\nIEAABD.DMPAUTH.\nIEAABD.DMPAKEY.\n\nThe RACF resource rules for the resources specify UACC(NONE) and NOWARNING.\n\nEnsure that no access is given to \"IEAABD.\" resource.\n\nExample:\nRDEF FACILITY IEAABD.** UACC(NONE) OWNER(owner group) AUDIT(ALL(READ))\n\nIEAABD.DMPAUTH. READ access is limited to authorized users that have a valid job duties requirement for access. WRITE or greater access will be restricted to system programming personnel and access will be logged.\n\nExample:\nRDEF FACILITY IEAABD.DMPAUTH.** UACC(NONE) OWNER(owner group) AUDIT(ALL(UPDATE))\n\nPERMIT IEAABD.DMPAUTH.** CLASS(FACILITY) ID(authusers) ACCESS(READ)\nPERMIT IEAABD.DMPAUTH.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\n\nIEAABD.DMPAKEY. access will be restricted to system programming personnel and access will be logged.\n\nExample:\nRDEF FACILITY IEAABD.DMPAKEY.** UACC(NONE) OWNER(owner group) AUDIT(ALL(READ))\n\nPERMIT IEAABD.DMPAKEY.** CLASS(FACILITY) ID(syspsmpl) ACCESS(READ)","ccis":["CCI-000213"]},{"vulnId":"V-223655","ruleId":"SV-223655r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS system commands must be properly protected.","description":"z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"From the ISPF Command Shell enter:\nRList OPERCMDS *\n\nIf the MVS.** resource is defined to the OPERCMDS class with an access of NONE and all (i.e., failures and successes) access logged, this is not a finding.\n\nIf the access to z/OS system commands defined in the table entitled MVS commands, RACF access authorities, and resource names, in the IBM z/OS MVS System Commands manual, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users) as determined in the Documented site Security Plan, this is not a finding.\n\nNote: Display commands and others as deemed by the site IAW site security plan may be allowed for all users with no logging. The (MVS.SEND) Command will not be a finding if used by all.\n\nIf all access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled MVS commands, RACF access authorities, and resource names, in the z/OS MVS System Commands, this is not a finding.","fixText":"z/OS system commands provide control over z/OS functions and can compromise security if misused. These commands are subject to various types of potential abuse. For this reason, it is necessary to place restrictions on the z/OS system commands that can be entered by particular operators.\n\nSome commands are particularly dangerous and should only be used when all less drastic options have been exhausted. Misuse of these commands can create a situation in which the only recovery is an IPL.\n\nApply the following recommendations when implementing security:\n\nThe MVS.** resource is defined to the OPERCMDS class with an access of NONE and all (i.e., failures and successes) access logged.\n\nAccess to z/OS system commands defined in the entitled MVS commands, RACF access authorities, and resource names, in the IBM z/OS MVS System Commands manual is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).\n\nThe (MVS.SEND) Command will not be a finding if used by all.\n\nDisplay commands and others as deemed by the site IAW site security plan may be allowed for all users with no logging. The (MVS.SEND) Command will not be a finding if used by all.\n\nAll elevated access (i.e., failures and successes) to specific z/OS system commands is logged.\n\nA sample set of commands to define and permit access to system command resources is shown here:\n\nRDEF OPERCMDS MVS.** UACC(NONE) OWNER(<syspsmpl>) AUDIT(ALL(READ)) DATA(\"set up deny-by-default profile')\n\nThen, in accordance with the referenced table, use the following template to define profiles for each command:\n\nRDEF OPERCMDS <system command profile> UACC(NONE) OWNER(<syspsmpl>) AUDIT(ALL(READ))\n\nPERMIT <system command profile> CLASS(OPERCMDS) ID(<groupname>) ACCESS(<accesslevel>)","ccis":["CCI-000213"]},{"vulnId":"V-223656","ruleId":"SV-223656r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must properly define users that have access to the CONSOLE resource in the TSOAUTH resource class.","description":"MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"If the CONSOLE privilege is not defined to the TSOAUTH resource class, this is not a finding.\n\nAt the discretion of the site, users may be allowed to issue z/OS system commands from a TSO session. With this in mind, review the following items for users granted the CONSOLE resource in the TSOAUTH resource class:\n\nIf Userids are restricted to the INFO level on the AUTH parameter specified in the OPERPARM segment of their userid, this is not a finding.\n\nIf Userids are restricted to READ access to the MVS.MCSOPER.userid resource defined in the OPERCMDS resource class, this is not a finding.\n\nIf Userids and/or group IDs are restricted to READ access to the CONSOLE resource defined in the TSOAUTH resource class, this is not a finding.","fixText":"Evaluate the impact of correcting any deficiencies. Develop a plan of action and implement the required changes. \nEnsure the following items are in effect for all MCS consoles:\n\nDefine a profile protecting the use of the CONSOLE command within TSO. A sample command to accomplish this is shown here: RDEF TSOAUTH CONSOLE UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) \n\nPermit only authorized users. A sample command to accomplish this is shown here: PE CONSOLE CL(TSOAUTH) ID(<syspsmpl>)\n\nSet up the OPERPARM segment in corresponding user-class entry. A sample command to accomplish this is shown here: ALU <authorized user> OPERPARM(AUTH(INFO))\n\nUserids are restricted to READ access to the MVS.MCSOPER.userid resource defined in the OPERCMDS resource class. A sample command to accomplish this is shown here using the GLOBAL class: \nRDEF GLOBAL OPERCMDS ADDMEM(MVS.MCSOPER.&RACUID/READ) OWNER(ADMIN)","ccis":["CCI-000213"]},{"vulnId":"V-223657","ruleId":"SV-223657r1137691_rule","severity":"medium","ruleTitle":"The IBM RACF FACILITY resource class must be active.","description":"IBM Provides the FACILITY Class for use in protecting a variety of features/functions/products both IBM and third-party. The FACILITY Class is not dedicated to any one specific use and is intended as a multi-purpose RACF Class. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nFrom the ISPF Command Shell enter:\nSETRopts List\n\nIf the FACILITY resource class is active, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe FACILITY Class is activated with the command SETR CLASSACT(FACILITY).\n\nGeneric profiles and commands should also be enabled with the command SETR GENERIC(FACILITY) GENCMD(FACILITY).\n\nIBM recommends RACLISTing the FACILITY Class which is accomplished with the command SETR RACL(FACILITY).","ccis":["CCI-000213"]},{"vulnId":"V-223658","ruleId":"SV-223658r1137691_rule","severity":"medium","ruleTitle":"The IBM RACF OPERCMDS resource class must be active.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nFrom the ISPF Command Shell enter:\nSETRopts List\n\nIf the OPERCMDS resource class is active, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe OPERCMDS Class is activated with the command SETR CLASSACT(OPERCMDS).\n\nGeneric profiles and commands should also be enabled with the command SETR GENERIC(OPERCMDS) GENCMD(OPERCMDS).\n\nIBM recommends RACLISTing the OPERCMDSClass which is accomplished with the command SETR RACL(OPERCMDS).","ccis":["CCI-000213"]},{"vulnId":"V-223659","ruleId":"SV-223659r1137691_rule","severity":"medium","ruleTitle":"The IBM RACF MCS consoles resource class must be active.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nFrom the ISPF Command Shell enter:\nSETRopts List\n\nIf the CONSOLE resource class is active, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe CONSOLE Class is activated with the command SETR CLASSACT(CONSOLE).\n\nGeneric profiles and commands should also be enabled with the command SETR GENERIC(CONSOLE) GENCMD(CONSOLE).\n\nIBM recommends RACLISTing the CONSOLE Class which is accomplished with the command SETR RACL(CONSOLE).","ccis":["CCI-000213"]},{"vulnId":"V-223660","ruleId":"SV-223660r1137691_rule","severity":"medium","ruleTitle":"IBM RACF CLASSACT SETROPTS must be specified for the TEMPDSN class.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nFrom the ISPF Command Shell enter:\nSETRopts List\n\nIf the TEMPDSN resource class is ACTIVE, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe TEMPDSN Class is activated with the command SETR CLASSACT(TEMPDSN).\n\nGeneric profiles and commands should also be enabled with the command SETR GENERIC(TEMPDSN) GENCMD(TEMPDSN).\n\nIBM recommends RACLISTing the TEMPDSN Class which is accomplished with the command SETR RACL(TEMPDSN).","ccis":["CCI-000213"]},{"vulnId":"V-223661","ruleId":"SV-223661r1137691_rule","severity":"medium","ruleTitle":"IBM RACF started tasks defined with the trusted attribute must be justified.","description":"Trusted Started tasks bypass RACF checking. It is vital that this attribute is NOT granted to unauthorized Started Tasks which could then obtain unauthorized access to the system. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, or customer data.","checkContent":"Refer to the list of z/OS started tasks and address spaces in the IBM z/OS MVS Initialization and Tuning Reference. \n\nIf the only approved Started Tasks that have the TRUSTED flag enabled are in this list, this is not a finding. \n\nIf there are no Started Tasks that have been granted the PRIVILEGED attribute, this is not a finding.\n\nGuidelines for reference:\n\nAssign the TRUSTED attribute when one of the following conditions applies:\n- The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation.\n- Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem.\nAvoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation.\n\nAdditionally external security managers are candidates for trusted attribute. \nAny other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official.","fixText":"Review assignment of the TRUSTED attribute in ICHRIN03 and/or the STARTED resource class. Ensure only those trusted STCs that are listed in the IBM z/OS MVS Initialization and Tuning Reference have been granted this authority. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes. While the actual list may vary based on local site requirements and software configuration, the started tasks listed in the IBM z/OS MVS Initialization and Tuning Reference is an approved list of started tasks that may be considered trusted started procedures. Guidelines for reference:\n\nAssign the TRUSTED attribute when one of the following conditions applies:\n-The started procedure or address space creates or accesses a wide variety of unpredictably named data sets within your installation.\n-Insufficient authority to an accessed resource might risk an unsuccessful IPL or other system problem.\n-Avoid assigning TRUSTED to a z/OS started procedure or address space unless it is listed here or you are instructed to do so by the product documentation.\n\nAdditionally external security managers are candidates for trusted attribute. Any other started tasks not listed or not covered by the guidelines are a finding unless approval by the Authorizing Official.\n\nThe TRUSTED attribute can be removed from a STARTED class profile using the command:\nRALT STARTED <profilename> STDATA(TRUSTED(NO))\n\nIf the STARTED class is RACLISTed then a refresh command is necessary:\nSETR RACL(STARTED) REFRESH\n\nIf any Started Tasks exist with the PRIVILEGED attribute then take the following action to remove this attribute:\nRALT STARTED <profilename> STDATA(PRIVILEGED(NO))\n\nIf the STARTED class is RACLISTed then a refresh command is necessary:\nSETR RACL(STARTED) REFRESH","ccis":["CCI-000213"]},{"vulnId":"V-223662","ruleId":"SV-223662r1137691_rule","severity":"medium","ruleTitle":"IBM RACF USERIDs possessing the Tape Bypass Label Processing (BLP) privilege must be justified.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF Command Shell enter:\nRLIST FACILITY ICHBLP AUTHUSER\n\nIf access authorization to the ICHBLP resource is restricted at the userid level to data center personnel (e.g., tape librarian, operations staff, etc.), this is not a finding.\n\nIf no tape management system (e.g., CA-1) is installed the following:\nFrom the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the TAPEVOL class is active, this is not a finding.","fixText":"Review all USERIDs with the BLP attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed.\n\nBLP is controlled thru the FACILITY class profile ICHBLP. Access is removed with the following command:\nPE ICHBLP CL(FACILITY) id(<userid>) DELETE\na subsequent REFRESH of the FACILITY class may be required via the command: SETR RACL(FACILITY) REFRESH","ccis":["CCI-000213"]},{"vulnId":"V-223663","ruleId":"SV-223663r1137691_rule","severity":"medium","ruleTitle":"IBM RACF DASD volume-level protection must be properly defined.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF Command Shell enter:\nRLIST DASDVOL AUTHUSER\n\nIf a profile of \"**\" is defined for the \"DASDVOL\" resource class, this is not finding.\n\nIf access authorization to \"DASDVOL\" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers, this is not a finding.\n\nIf all (i.e., failures and successes) access is logged, this is not a finding.","fixText":"Develop a plan of action to implement the required changed.\n\nDefine profiles in the \"DASDVOL\" class. A sample command is provided here: \nRDEF DASDVOL ** UACC(NONE) OWNER(<StgMgmtGrp>) AUDIT(ALL(READ)).\n\nMore specific \"DASDVOL\" profiles should be defined to protect groups of \"DASDVOLs\". A sample command to create a profile protecting all DASDVOLs beginning with \"SYS\" is provided here: \nRDEF DASDVOL SYS* UACC(NONE) OWNER(<StgMgmtGrp>) AUDIT(ALL(READ)).\n\nPermission can be granted to \"DASDVOL\" profiles. A sample command is provided here: \nPE SYS* CLASS(DASDVOL) ID(<syspsmpl>) ACCESS(ALTER)\n\nIf any profiles are in \"WARN\" mode, they should be reset. A sample command is provided here: \nRALT DASDVOL <profilename> NOWARN.\n\nNote that the \"GDASDVOL\" class can also be used. See the RACF Security Admin Guide for more information.","ccis":["CCI-000213"]},{"vulnId":"V-223664","ruleId":"SV-223664r1137691_rule","severity":"medium","ruleTitle":"IBM Sensitive Utility Controls must be properly defined and protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"If the RACF resource access authorizations for the following sensitive utilities restrict access to the appropriate personnel according to the site security plan, this is not a finding.\n\nIf all access for these sensitive utilities is audited, this is not a finding.\n\nSensitive Utility Controls\nProgram Product Function \nAHLGTF z/OS System Activity Tracing \nHHLGTF\nIHLGTF \n\nICPIOCP z/OS System Configuration \nIOPIOCP\nIXPIOCP\nIYPIOCP\nIZPIOCP \n\nBLSROPTR z/OS Data Management \n\nDEBE OS/DEBE Data Management \n\nDITTO OS/DITTO Data Management \n\nFDRZAPOP FDR Product Internal Modification \n\nGIMSMP SMP/E Change Management Product \n\nICKDSF z/OS DASD Management \n\nIDCSC01 z/OS IDCAMS Set Cache Module \n\nIEHINITT z/OS Tape Management \n\nIFASMFDP z/OS SMF Data Dump Utility \n\nIND$FILE z/OS PC to Mainframe File Transfer\n(Applicable only for classified systems) \n\nCSQJU003 IBM WebSphereMQ\nCSQJU004\nCSQUCVX\nCSQ1LOGP\nCSQUTIL \n\nWHOIS z/OS Share MOD to identify user name from USERID. \nRestricted to data center personnel only.","fixText":"Note: The resources and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.\n\nEnsure that all Sensitive Utility Controls resources and/or generic equivalent are properly protected according to the site security plan.\n\nUse Sensitive Utility Controls table below that lists the resources, access requirements, and logging requirements for Sensitive Utilities, ensuring the following guidelines are followed:\n\nSensitive Utility Controls\nProgram Product Function \nAHLGTF z/OS System Activity Tracing \nHHLGTF\nIHLGTF \n\nICPIOCP z/OS System Configuration \nIOPIOCP\nIXPIOCP\nIYPIOCP\nIZPIOCP \n\nBLSROPTR z/OS Data Management \n\nDEBE OS/DEBE Data Management \n\nDITTO OS/DITTO Data Management \n\nFDRZAPOP FDR Product Internal Modification \n\nGIMSMP SMP/E Change Management Product \n\nICKDSF z/OS DASD Management \n\nIDCSC01 z/OS IDCAMS Set Cache Module \n\nIEHINITT z/OS Tape Management \n\nIFASMFDP z/OS SMF Data Dump Utility \n\nIND$FILE z/OS PC to Mainframe File Transfer\n (Applicable only for classified systems) \n\nCSQJU003 IBM WebSphereMQ\nCSQJU004\nCSQUCVX\nCSQ1LOGP\nCSQUTIL \n\nWHOIS z/OS Share MOD to identify user name from USERID. \n Restricted to data center personnel only.\n\nThe RACF resources as designated in the table above are defined with a default access of NONE.\n\nThe RACF resource access authorizations restrict access to the appropriate personnel as designated in the table above.\n\nThe RACF resource rules for the resources designated in the table above specify UACC(NONE) and NOWARNING.\n\nThe following commands are provided as a sample for implementing resource controls:\n\nRDEF PROGRAM AHLGTF ADDMEM('SYS1.LINKLIB'//NOPADCHK) - \nDATA('ADDED PER SRR PDI RACF0770 ') - \nAUDIT(ALL(READ)) UACC(NONE) OWNER(ADMIN)\nPERMIT AHLGTF CLASS(PROGRAM) ID(stcgsmpl)","ccis":["CCI-000213"]},{"vulnId":"V-223665","ruleId":"SV-223665r1195461_rule","severity":"medium","ruleTitle":"IBM RACF Global Access Checking must be restricted to appropriate classes and resources.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From a command input screen, enter:\n\nRL Global *\n\nIf Global * is specified in SETROPTS, this is a finding.\n\nThe following entries may be allowed with the approval of the information system security manager (ISSM):\n\nDataset Class - ALTER access level to &RACUID.** (Allows users all access to their own datasets)\nOPERCMDS Class - READ access to MVS.MCSOPER.&RACUID (Allows users access to console for their jobs) \nJESJOBS Class - ALTER access to CANCEL.*.*.&RACUID (Allows users to cancel their own jobs)\nJESJOBS Class - ALTER access to SUBMIT.*.*.&RACUID (Allows users to submit their own jobs)\n\nThe ISSM may allow other classes to be included after evaluation with the system programmer.\n\nNote: Be careful when adding any resource requiring auditing to Global Access Checking. RACF performs no logging other than that requested by the SETROPTS LOGOPTIONS command. There are other special consideration for global access checking found in the z/OS Security Server RACF Security Administrator's Guide.\n\nIf any other members are included for Global Access Checking, this is a finding.\n\nIf written approval by the ISSM is not provided, this is a finding.","fixText":"Configure Global Access Checking to be appropriately administered.\n\nNote: Special consideration should be followed as indicated in z/OS Security Server RACF Security Administrator's Guide.\n\nEvaluate the impact associated with implementation of the control option. Develop approval documentation and a plan of action to implement the control option as specified in the example below: \n\nRALT GLOBAL class-name\nADDMEM (resourcename)/accesslevel)","ccis":["CCI-000213"]},{"vulnId":"V-223666","ruleId":"SV-223666r1137691_rule","severity":"high","ruleTitle":"IBM RACF access to the System Master Catalog must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Refer to SYSCATxx member of SYS1.NUCLEUS.\n\nMultiple SYSCATxx members may be defined. If so, refer to Master Catalog message for IPL.\n\nIf the member is not found, refer to the appropriate LOADxx member of SYS1.PARMLIB.\n\nIf data set rules for the Master Catalog do not restrict greater than \"READ\" access to only z/OS systems programming personnel, this is a finding.\n\nIf Products or procedures requiring system programmer access for system-level maintenance meet the following specific case, this is not a finding:\n- The batch job or procedure must be documented in the SITE Security Plan. \n- Reside in a data set that is restricted to systems programmers' access only. \n\nIf dataset rules for the Master Catalog do not specify that all (i.e., failures and successes) greater than \"READ\" access will be logged, this is a finding.","fixText":"Review access authorization to critical system files.\n\nEvaluate the impact of correcting the deficiency.\n\nDevelop a plan of action and implement the changes as required to protect the MASTER CATALOG.\n\nConfigure the ESM rules for system catalog to only allow access above \"READ\" to systems programmers and those authorized by the ISSM/ISSO.\n\nConfigure ESM rules for the master catalog to allow access above \"READ\" to systems programmers ONLY.\n\nConfigure ESM rules for the master catalog to allow any products or procedures system programmer access for system-level maintenance that meets the following specific case:\n- The batch job or procedure must be documented in the SITE Security Plan. \n- Reside in a data set that is restricted to systems programmers' access only.\n\nAll greater than read access must be logged.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223667","ruleId":"SV-223667r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to SYS1.UADS to system programmers only, and WRITE or greater access must be limited to system programmer personnel and/or security personnel.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"The ESM data set rules for SYS1.UADS restrict WRITE or Greater access to only z/OS systems programming personnel.\n\nThe ESM data set rules for SYS1.UADS restrict READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.\n\nThe ESM data set rules for SYS1.UADS restrict READ access to auditors as documented in Security Plan.\n\nThe ESM data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.\n\nIf all of the above are untrue, this is not a finding.\n\nIf any of the above is true, this is a finding.","fixText":"Evaluate the impact of correcting any deficiency. Develop a plan of action and implement the changes as required to protect SYS1.UADS.\nSYS1.UADS WRITE or Greater authority is limited to the systems programming staff. \nREAD and/or UPDATE access should be limited to the security staff.\nREAD access is limited to Auditors when included in the site security plan.\nConfigure allocate access to SYS1.UADS to be limited to system programmers only, Read and Update access to SYS1.UADS to be limited to system programmer personnel and/or security personnel, and all dataset access is logged.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223668","ruleId":"SV-223668r1137691_rule","severity":"high","ruleTitle":"IBM z/OS must protect dynamic lists in accordance with proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Execute RACF command:\nRLIST FACILITY *\n\nIf the RACF resources and/or generic equivalent identified below are defined with AUDIT(ALL(READ)) and WRITE or greater access restricted to system programming personnel, this is not a finding.\n\nCSVAPF.\nCSVAPF.MVS.SETPROG.FORMAT.DYNAMIC\nCSVAPF.MVS.SETPROG.FORMAT.STATIC\nCSVDYLPA.\nCSVDYNEX.\nCSVDYNEX.LIST\nCSVDYNL.\nCSVDYNL.UPDATE.LNKLST\nCSVLLA.\n\nIf the RACF CSVDYNEX.LIST resource and/or generic equivalent is defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and WRITE or greater access restricted to system programming personnel, this is not a finding.\n\nIf the RACF CSVDYNEX.LIST resource and/or generic equivalent is defined with READ access restricted to auditors, this is not a finding.\n\nIf the products CICS and/or CONTROL-O are on the system, the RACF access to the CSVLLA resource and/or generic equivalent will be defined with AUDIT(ALL) and UPDATE access restricted to the CICS and CONTROL-O STC userids.\n\nIf any software product requires access to dynamic LPA updates on the system, the RACF access to the CSVDYLPA resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) only after the product has been validated with the appropriate STIG or SRG for compliance AND receives documented and filed authorization that details the need and any accepted risks from the site ISSM or equivalent security authority.\n\nNote: In the above, UPDATE access can be substituted with ALTER or CONTROL. Review the permissions in the IBM documentation when specifying UPDATE.","fixText":"Configure the Dynamic List resources to be defined to the RACF FACILITY resource class and protected. Only system programmers and a limited number of authorized users and approved authorized Started Tasks are able to issue these commands. All access is logged.\n\nThe required CSV-prefixed Facility Class resources are listed below. These resources or generic equivalents should be defined and permitted as required with only z/OS systems programmers and logging enabled. Minimum required list of CSV-prefixed resources:\n\nCSVAPF.**\nCSVAPF.MVS.SETPROG.FORMAT.DYNAMIC\nCSVAPF.MVS.SETPROG.FORMAT.STATIC\nCSVDYLPA.**\nCSVDYLPA.ADD.**\nCSVDYLPA.DELETE.**\nCSVDYNEX.**\nCSVDYNEX.LIST\nCSVDYNL.**\nCSVDYNL.UPDATE.LNKLST\nCSVLLA.**\n\nLimit authority to those resources to z/OS systems programmers. Restrict to the absolute minimum number of personnel with AUDIT(ALL(READ)) and UPDATE access.\n\nSample commands are shown here to accomplish this:\n\nRDEF FACILITY CSVAPF.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\nRDEF FACILITY CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\nRDEF FACILITY CSVAPF.MVS.SETPROG.FORMAT.STATIC.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\n\nPERMIT CSVAPF.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVAPF.MVS.SETPROG.SETPROG.FORMAT.DYNAMIC.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVAPF.MVS.SETPROG.SETPROG.FORMAT.STATIC.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\n\nThe CSVDYLPA.ADD resource will be permitted to products BMC Mainview, CA 1, and CA Common Services STC userids with AUDIT(ALL(READ)) and UPDATE access.\n\nThe CSVDYLPA.DELETE resource will be permitted to products CA 1 and CA Common Services STC userids with AUDIT(ALL(READ)) and UPDATE access.\n\nSample commands are shown here to accomplish one set of resources:\n\nRDEF FACILITY CSVDYLPA.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\nRDEF FACILITY CSVDYLPA.ADD.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\nRDEF FACILITY CSVDYLPA.DELETE.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\n\nPERMIT CSVDYLPA.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVDYLPA.** CLASS(FACILITY) ID(BMC Mainview STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.** CLASS(FACILITY) ID(CA 1 STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.** CLASS(FACILITY) ID(CCS STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.ADD.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVDYLPA.ADD.** CLASS(FACILITY) ID(BMC Mainview STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.ADD.** CLASS(FACILITY) ID(CA 1 STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.ADD.** CLASS(FACILITY) ID(CCS STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.DELETE.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVDYLPA.DELETE.** CLASS(FACILITY) ID(CA 1 STC userid) ACCESS(UPDATE)\nPERMIT CSVDYLPA.DELETE.** CLASS(FACILITY) ID(CCS STC userid) ACCESS(UPDATE)\n\nThe CSVDYNEX.LIST resource and/or generic equivalent will be defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and UPDATE access restricted to system programming personnel.\n\nThe CSVDYNEX.LIST resource and/or generic equivalent will be defined with READ access restricted to auditors.\n\nSample commands are shown here to accomplish this:\n\nRDEF FACILITY CSVDYNEX.** UACC(NONE) OWNER(syspsmpl) -\nAUDIT(ALL(READ))\nRDEF FACILITY CSVDYNEX.LIST.** UACC(NONE) OWNER(syspsmpl) -\nAUDIT(FAILURE(READ)SUCCESS(UPDATE))\n\nPERMIT CSVDYNEX.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVDYNEX.LIST.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVDYNEX.LIST.** CLASS(FACILITY) ID(smplsmpl) ACCESS(READ)\n\nThe CSVLLA resource will be permitted to CICS and CONTROL-O STC userids with AUDIT(ALL(READ)) and UPDATE access.\n\nSample commands are shown here to accomplish one set of resources:\n\nRDEF FACILITY CSVLLA.** UACC(NONE) OWNER(syspsmpl) AUDIT(ALL(READ))\n\nPERMIT CSVLLA.** CLASS(FACILITY) ID(syspsmpl) ACCESS(UPDATE)\nPERMIT CSVLLA.** CLASS(FACILITY) ID(CICS STC userids) ACCESS(UPDATE)\nPERMIT CSVLLA.** CLASS(FACILITY) ID(CONTROL-O STC userid) ACCESS(UPDATE)","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223669","ruleId":"SV-223669r1195296_rule","severity":"medium","ruleTitle":"IBM RACF allocate access to system user catalogs must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"From the ISPF Command Shell enter:\nLISTCat USERCATALOG ALL NOPREFIX\n\nReview the ESM data set rules for each usercatalog defined.\n\nIf the data set rules for User Catalogs do not restrict ALTER access to only z/OS systems programming personnel, this is a finding.\n\nIf Products or procedures requiring system programmer access for system-level maintenance meets the following specific case, this is not a finding:\n- The batch job or procedure must be documented in the SITE Security Plan. \n- Reside in a data set that is restricted to systems programmers' access only. \n\nIf the data set rules for User Catalogs do not specify that all (i.e., failures and successes) ALTER access will be logged, this a finding.\n\nNote: If the USER CATALOGS contain SMS managed data sets READ access is sufficient to allow user operations. If the USER CATALOGS do not contain SMS managed data sets UPDATE access is required for user operation.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect USER CATALOGS.\n\nConfigure ESM rules for allocate access to USER CATALOGS, limited to system programmers only, and all allocate access is logged.\n\nConfigure ESM rules for the USER CATALOGS to allow any products or procedures system programmer access for system-level maintenance that meets the following specific case:\n- The batch job or procedure must be documented in the SITE Security Plan. \n- Reside in a data set that is restricted to systems programmers' access only.   \n\nNote: If the USER CATALOGS contain SMS managed data sets READ access is sufficient to allow user operations. If the USER CATALOGS do not contain SMS managed data sets UPDATE access is required for user operation.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223670","ruleId":"SV-223670r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit WRITE or greater access to System backup files to system programmers and/or batch jobs that perform DASD backups.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Collect from the storage management group the identification of the DASD backup files and all associated storage management userids.\n\nIf ESM data set rules for system DASD backup files do not restrict WRITE or greater access to z/OS systems programming and/or batch jobs that perform DASD backups, this is a finding.\n\nIf  READ Access to system backup data sets is not limited to auditors and others approved by the ISSM, this is a finding.","fixText":"Obtain the high level indexes to backup data sets names define their access to be restricted by the System's ESM to System Programmers and batch jobs that perform the backups. Define READ Access to system backup data sets to be limited to auditors and others approved by the ISSM.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223671","ruleId":"SV-223671r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit access to SYS(x).TRACE to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Execute a dataset list of access for SYS(x).TRACE files.\n\nIf the ESM data set rule for SYS1.TRACE restricts access to systems programming personnel and started tasks that perform GTF processing, this is not a finding.\n\nIf the ESM data set rule for SYS1.TRACE restricts access to others as documented and approved by ISSM, this is not a finding.","fixText":"Configure the ESM access to SYS1.TRACE to be limited to system programmers or started tasks that perform GTF processing.\nOther user access can be granted as documented and approved by the ISSM.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223672","ruleId":"SV-223672r1137691_rule","severity":"medium","ruleTitle":"IBM RACF batch jobs must be properly secured.","description":"Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000326-GPOS-00126","checkContent":"Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids. Determine any other scheduled batch jobs on the system.\n\nFrom an ISPF Command Shell enter:\nRLIST SURROGAT *\n\nIf each batch job userid used for batch submission by a Job Scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile, this is not a finding.\n\nFrom an ISPF Command Shell enter:\nRLIST SURROGAT <surrogat-userid> ALL\n\nIf the Job Scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles, this is not a finding.","fixText":"Configure each batch job userid used for batch submission by a Job Scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example:\n\nRDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE)\nOWNER(execution-userid)\n\nConfigure Job Scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example:\n\nPERMIT execution-userid.SUBMIT CLASS(SURROGAT)\nID(surrogate-userid) ACCESS(READ)","ccis":["CCI-000213","CCI-002233"]},{"vulnId":"V-223673","ruleId":"SV-223673r1137691_rule","severity":"medium","ruleTitle":"IBM RACF batch jobs must be protected with propagation control.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000326-GPOS-00126","checkContent":"Refer to a list all Multiple User Access Systems in use on this system. These are systems that run in a single address space, but allow multiple users to sign on to them (e.g., CICS regions, Session Managers, etc.). For each region, also include corresponding userids, profiles, data management files, and a brief description (of each region). \n\nRefer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.\n\nIf the submission of batch jobs via an automated process (e.g., job scheduler, job submission started task, etc.) is being utilized, and/or Multiple User Single Address Space Systems (MUSASS) capable of submitting batch jobs are active on this system and the following items are in effect, this is not a finding.\n\nThe PROPCNTL resource class is active.\nA PROPCNTL resource class profile is defined for each userid associated with a job scheduler (e.g., CONTROL-M, CA-7, etc.) and a MUSASS able to submit batch jobs (e.g., CA-ROSCOE, etc.).","fixText":"Add a PROPCNTL profile for each userid associated with a job scheduler (e.g., CONTROL-M, CA-7, etc.) or a MUSASS able to submit batch jobs (e.g., CA-ROSCOE, etc.). \n\nA sample command is shown here:\nRDEF PROPCNTL controlm UACC(NONE) OWNER(ADMIN)","ccis":["CCI-000213","CCI-002233"]},{"vulnId":"V-223674","ruleId":"SV-223674r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to SYS1.IMAGELIB to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"Execute a dataset list of access for SYS1.IMAGELIB.\n\nIf the following guidance is true, this is not a finding.\n\n-The ACP data set rules for SYS1.IMAGELIB do not restrict WRITER or greater access to only systems programming personnel.\n-The ACP data set rules for SYS1.IMAGELIB do not specify that all (i.e., failures and successes) WRITER or greater access will be logged.","fixText":"Configure UPDATE and/or ALLOCATE access to SYS1.IMAGELIB to be limited to system programmers only and all WRITE or greater access is logged.\n\nReview access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect SYS1.IMAGELIB.\n\nSYS1.IMAGELIB is automatically APF-authorized. This data set contains modules, images, tables, and character sets which are essential to system print services.","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223675","ruleId":"SV-223675r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to SYS1.SVCLIB to appropriate authorized users.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Execute a dataset list of access for SYS1.SVCLIB.\n\nIf all of the following are true, this is not a finding.\n\nIf any of the following are untrue, this is a finding.\n\n-ESM data set rules for SYS1.SVCLIB restrict WRITE or greater access to only z/OS systems programming personnel.\n-ESM data set rules for SYS1.SVCLIB specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Configure Write or greater access to SYS1.SVCLIB to be limited to system programmers only and all WRITE or greater access is logged and reviewed. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes for SYS1.SVCLIB. SYS1.SVCLIB contains SVCs and I/O appendages as such: they are very powerful and will be strictly controlled to avoid compromising system integrity.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223676","ruleId":"SV-223676r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to SYS1.LPALIB to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Execute a dataset list of access for SYS1.LPALIB.\n\nIf any of the following is true, this is a finding.\n\n-The ESM data set rules for SYS1.LPALIB do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ESM data set rules for SYS1.LPALIB do not specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect SYS1.LPALIB. \n\nConfigure WRITE or greater access to SYS1.LPALIB to be limited to system programmers only and all WRITE or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223677","ruleId":"SV-223677r1137691_rule","severity":"high","ruleTitle":"IBM z/OS libraries included in the system REXXLIB concatenation must be properly protected.","description":"Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Refer to AXRxx member of PARMLIB, for each REXXLIB ADD statement: \n\nIf the ESM data set rules for libraries in the REXXLIB concatenation restrict WRITE or greater access to only z/OS systems programming personnel, this is not a finding.\n\nIf ESM dataset rules for libraries in the REXXLIB concatenation restrict GLOBAL read access, this is not a finding.\n\nIf ESM data set rules for libraries in the REXXLIB concatenating restrict WRITE or Greater access to z/OS system Programmers, this is not a finding.\n\nIf the ESM data set rules for libraries in the REXXLIB concatenation restrict READ access to the following, this is not a finding.\n\n-Appropriate Started Tasks\n-Auditors\n-User-id defined in PARMLIB member AXR00 AXRUSER(user-id)\n\nIf the ESM data set rules for libraries in the REXXLIB concatenation specify that all (i.e., failures and successes) WRITE or greater access will be logged, this is not a finding.","fixText":"Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect APF Authorized Libraries. \n\nConfigure ESM dataset rules to limit WRITE or greater access to libraries included in the system REXXLIB concatenation to system programmers only.\n\nConfigure ESM dataset rules allow READ access to only appropriate Started Tasks and Auditors.\n\nConfigure ESM dataset rules to log UPDATE and/or ALTER access (i.e., successes and failures).","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223678","ruleId":"SV-223678r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit write or greater access to all LPA libraries to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"From Any ISPF input line, enter:\nTSO ISRDDN LPA. \n\nIf any of the following is true, this is a finding.\n\n-The ACP data set rules for LPA libraries do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ACP data set rules for LPA libraries do not specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect LPA Libraries.\n\nConfigure the WRITE or greater access to all LPA libraries to be limited to system programmers only and all WRITE or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223679","ruleId":"SV-223679r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit Write or greater access to libraries containing EXIT modules to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Examine the system for active exit modules. The system administrator may have to help for this. Third-party software products can determine standard and dynamic exits loaded in the system.\n\nIf all the exits are found within APF, LPA, and LINKLIST, this is Not Applicable.\n\nIf ESM data set rules for libraries that contain system exit modules restrict WRITE or greater access to only z/OS systems programming personnel, this is not a finding.\n\nIf the ESM data set rules for libraries that contain exit modules specify that all WRITE or greater access will be logged, this is not a finding.","fixText":"Using the ESM, protect the data sets associated with all product exits installed in the z/OS environment. This reduces the potential of a hacker adding a routine to a library and possibly creating an exposure. Confirm that all exits are tracked using a CMP. Develop usermods to include the source/object code used to support the exits. Have systems programming personnel review all z/OS and other product exits to confirm that the exits are required and are correctly installed. \n\nConfigure ESM Dataset rules for all WRITE or greater access to libraries containing z/OS and other system-level exits will be logged using the ACP's facilities. Only systems programming personnel will be authorized to update the libraries containing z/OS and other system-level exits.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223680","ruleId":"SV-223680r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit WRITE or greater access to all system-level product installation libraries to system programmers.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Have the systems programmer for z/OS supply the following information:\n\nThe data set name and associated SREL for each SMP/E CSI utilized to maintain this system.\nThe data set name of all SMP/E TLIBs and DLIBs used for installation and production support. A comprehensive list of the SMP/E DDDEFs for all CSIs may be used if valid.\n\nIf the ESM data set rules for system-level product installation libraries (e.g., SMP/E CSIs) do not restrict WRITE or greater access to only z/OS systems programming personnel this is a finding.\n\nIf any of these data sets cannot be identified due to a lack of requested information, this is a finding.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect System-level product installation libraries.\n\nConfigure allocate access to all system-level product execution libraries to be limited to system programmers only.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223681","ruleId":"SV-223681r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit access to SYSTEM DUMP data sets to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Ask the system administrator and/or DASD administrator to determine the System Dump data sets. \n\nRefer to data sets SYS1.DUMPxx, additionally, Dump data sets can be identified by reviewing the logical parmlib concatenation data sets for the current COMMNDxx member. Find the COM= which specifies the DUMPDS NAME (DD NAME=name-pattern) entry. The name-pattern is used to identify additional Dump data sets.\n\nIf ESM data set rules for System Dump data sets do not restrict READ, UPDATE, and/or ALTER access to only systems programming personnel, this is a finding.\n\nIf ESM data set rules for all System Dump data sets do not restrict READ access to personnel having justification to review these dump data, this is a finding.","fixText":"Configure data set rules for access to SYSTEM DUMP data set(s) to be limited to system programmers only, unless a letter justifying access is filed with the ISSO in the site security plan.\n\nEvaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to restrict access to these data sets.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223682","ruleId":"SV-223682r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit WRITE or greater access to all APF-authorized libraries to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125, SRG-OS-000324-GPOS-00125","checkContent":"From Any ISPF input line, enter TSO ISRDDN APF. \n\nIf all of the following are untrue, this is not a finding.\n\nIf any of the following are true, this is a finding.\n\n-The ACP data set rules for APF libraries do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ACP data set rules for APF libraries do not specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect APF Authorized Libraries. \n\nConfigure, WRITE, or greater access to all APF-authorized libraries to be limited to system programmers only and all WRITE or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223683","ruleId":"SV-223683r1137691_rule","severity":"medium","ruleTitle":"IBM RACF access to SYS1.LINKLIB must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125, SRG-OS-000362-GPOS-00149","checkContent":"Execute a dataset list of access to SYS1.LINKLIB.\n\nIf the ESM data set rules for SYS1.LINKLIB allow inappropriate (e.g., global READ) access, this is a finding.\n\nIf data set rules for SYS1.LINKLIB do not restrict READ, UPDATE, and ALTER access to only systems programming personnel, this is a finding.\n\nIf data set rules for SYS1.LINKLIB do not restrict READ and UPDATE access to only domain level security administrators, this is a finding.\n\nIf data set rules for SYS1.LINKLIB do not restrict READ access to only system Level Started Tasks, authorized Data Center personnel, and auditors, this is a finding.\n\nIf data set rules for SYS1.LINKLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged, this is a finding.","fixText":"Configure the ESM rules for SYS1.LINKLIB to limit access to system programmers only and all update and allocate access is logged.","ccis":["CCI-000213","CCI-001499","CCI-003980","CCI-002235"]},{"vulnId":"V-223684","ruleId":"SV-223684r1137691_rule","severity":"high","ruleTitle":"The IBM RACF System REXX IRRPWREX security data set must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSecurity functions are the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Operating systems implement code separation (i.e., separation of security functions from nonsecurity functions) in a number of ways, including through the provision of security kernels via processor rings or processor modes. For non-kernel code, security function isolation is often achieved through file system protections that serve to protect the code on disk and address space protections that protect executing code.\n\nDevelopers and implementers can increase the assurance in security functions by employing well-defined security policy models; structured, disciplined, and rigorous hardware and software development techniques; and sound system/security engineering principles. Implementation may include isolation of memory space and libraries. Operating systems restrict access to security functions through the use of access control mechanisms and by implementing least privilege capabilities.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000134-GPOS-00068, SRG-OS-000259-GPOS-00100","checkContent":"Refer to the zOS system REXXLIB concatenation found in SYS1. PARMLIB (AXR) for the data set that contains the REXX for Password exit named IRRPWREX and the defined AXRUSER.\n\nIf the following guidance is true, this is not a finding.\n\n-RACF data set access authorizations restrict READ to AXRUSER, z/OS systems programming personnel, security personnel, and auditors.\n-RACF data set access authorizations restrict UPDATE to security personnel using a documented change management procedure to provide a mechanism for access and revoking of access after use.\n-All (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, and CONTROL) is logged.\n-RACF data set access authorizations specify UACC(NONE) and NOWARNING.","fixText":"Configure read access to be restricted to security administrators, systems programmers, and auditors.\n\nEstablish a procedure documented with the ISSM that defines a change management process to provide mechanism for granting Update access to security administrators on an exception basis. The process should contain procedures to revoke access when documented update is completed.\n\nConfigure all failures and successes data set access authorities for RACF data set that contains the Password exit to be logged.\n\nExamples:\nad 'sys3.racf.rexxlib.**' uacc(none) owner(sys3) -\naudit(all(read)) \nPermit 'sys3.racf.rexxlib.**' id(<syspsmpl> <secasmpl> <smplsmpl> AXRUSER) acc(r)\nPermit 'sys3.racf.rexxlib.**' id(<secasmpl>) acc(u)","ccis":["CCI-000213","CCI-001084","CCI-001499"]},{"vulnId":"V-223685","ruleId":"SV-223685r1137691_rule","severity":"high","ruleTitle":"IBM RACF security data sets and/or databases must be properly protected.","description":"The External Security Manager (ESM) database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000134-GPOS-00068, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"If the following accesses to the ESM security data sets and/or databases are properly restricted as detailed below, this is not a finding.\n\n-The ESM data set rules for ESM security data sets and/or databases restrict READ access to auditors and DASD batch.\n-The ESM data set rules for ESM security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ESM maintenance.\n\nAll (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) for ESM security data sets and/or databases are logged.","fixText":"Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ESM files.\n\nConfigure READ and/or greater access to all ESM files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ESM maintenance. READ access can be given to auditors and DASD batch. All accesses to ESM files and/or databases are logged.","ccis":["CCI-000213","CCI-001084","CCI-001499","CCI-002235"]},{"vulnId":"V-223686","ruleId":"SV-223686r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000206-GPOS-00084, SRG-OS-000324-GPOS-00125","checkContent":"Obtain the procedures and collection specifics for SMF datasets and backup.\n\nIf the ESM data set rules for the SMF dump/backup files do not restrict WRITE or greater to authorized DISA and site personnel (e.g., systems programmers and batch jobs that perform SMF processing), this is a finding.\n\nIf the ESM dataset rules for the SMF dump/backup files do not restrict update access as documented in the site security plan, this is a finding.\n\nIf the ESM data set rules for the SMF dump/backup files do not restrict READ access to auditors and others approved by the ISSM, this is a finding.\n\nIf the ESM data set rules for SMF dump/backup files do not specify that all (i.e., failures and successes) WRITE or greater will be logged, this is a finding.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect datasets used to backup and/or dump SMF collection files.\n\nConfigure data set rules for the SMF dump/backup files to restrict WRITE or greater access to authorized DISA and site personnel (e.g., systems programmers and batch jobs that perform SMF processing).\n\nConfigure data set rules for the SMF dump/backup files to restrict UPDATE access to others approved the ISSM.\n\nConfigure data set rules for the SMF dump/backup files to restrict READ access to authorized auditors and others approved by the ISSM.\n\nEnsure that all WRITE or greater access authority to SMF history files will be logged using the ESM's facilities.","ccis":["CCI-000213","CCI-001314","CCI-002235"]},{"vulnId":"V-223687","ruleId":"SV-223687r1137691_rule","severity":"high","ruleTitle":"IBM RACF must limit all system PROCLIB data sets to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Refer to the following for the PROCLIB data sets that contain the STCs and TSO logons from the following sources:\n\n- MSTJCLxx member used during an IPL. The PROCLIB data sets are obtained from the IEFPDSI and IEFJOBS DD statements.\n\n- PROCxx DD statements and JES2 Dynamic PROCLIBs where 'xx' is the PROCLIB entries for the STC and TSU JOBCLASS configuration definitions. \n\nVerify the accesses to the above PROCLIB data sets are properly restricted. \n\nIf the following guidance is true, this is not a finding.\n\nIf the ESM data set access authorizations restrict READ access to all authorized users, this is not a finding.\n\nIf the ESM data set access authorizations restrict WRITE and/or greater access to systems programming personnel, this is not a finding.","fixText":"Configure ESM dataset rules to restrict all WRITE and/or greater access to all PROCLIBs referenced in the Master JCL and JES2 or JES3 procedure for started tasks (STCs) and TSO logons to systems programming personnel only.\n\nSuggestion on how to update system to be compliant with this vulnerability:\n\nNOTE: All examples are only examples and may not reflect your operating environment.\n\nObtain only the PROCLIB data sets that contain STC and TSO procedures. The data sets to be reviewed are obtained using the following steps:\n\n- All data sets contained in the MSTJCLxx member in the DD statement concatenation for IEFPDSI and IEFJOBS.\n- The data set in the PROCxx DD statement concatenation that is within the JES2 procedure or identified in the JES2 dynamic PROCLIB definitions. The specific PROCxx DD statement that is used is obtained from the PROCLIB entry for the JOBCLASSes of STC and TSU. The following are the data sets the process will obtain for analysis:\n\nMSTJCL00\n\n//MSTJCL00 JOB MSGLEVEL=(1,1),TIME=1440 \n//EXEC PGM=IEEMB860,DPRTY=(15,15) \n//STCINRDR DD SYSOUT=(A,INTRDR) \n//TSOINRDR DD SYSOUT=(A,INTRDR) \n//IEFPDSI DD DSN=SYS3.PROCLIB,DISP=SHR <<===\n//DD DSN=SYS2.PROCLIB,DISP=SHR <<===\n//DD DSN=SYS1.PROCLIB,DISP=SHR <<===\n//SYSUADS DD DSN=SYS1.UADS,DISP=SHR \n//SYSLBC DD DSN=SYS1.BRODCAST,DISP=SHR\n\nJES2\n\n//JES2 PROC \n//IEFPROC EXEC PGM=HASJES20,PARM=NOREQ, \n//DPRTY=(15,15),TIME=1440,PERFORM=9 \n//ALTPARM DD DISP=SHR, \n//DSN=SYS1.PARMLIB(JES2BKUP) \n//HASPPARM DD DISP=SHR, \n//DSN=SYS1.PARMLIB(JES2PARM) \n//PROC00 DD DSN=SYS3.PROCLIB,DISP=SHR <<===\n//DD DSN=SYS2.PROCLIB,DISP=SHR <<===\n//DD DSN=SYS1.PROCLIB,DISP=SHR <<===\n//PROC01 DD DSN=SYS4.USERPROC,DISP=SHR \n//DD DSN=SYS3.PROCLIB,DISP=SHR \n//DD DSN=SYS2.PROCLIB,DISP=SHR \n//DD DSN=SYS1.PROCLIB,DISP=SHR \n//IEFRDER DD SYSOUT=* \n//HASPLIST DD DDNAME=IEFRDER\n\nJES2 initialization parameter JOBCLASS PROCLIB entries\n\nJOBCLASS(*) ACCT=NO, /* ACCT # NOT REQUIRED (DEF.)*/ \n...\nPROCLIB=01, /* DEFAULT TO //PROC01 DD (DEF.)*/\n...\nJOBCLASS(STC) AUTH=ALL, /* ALLOW ALL COMMANDS (DEF.)*/ \n...\nPROCLIB=00, /* USE //PROC00 DD (DEF.)*/ \n...\nJOBCLASS(TSU) AUTH=ALL, /* ALLOW ALL COMMANDS (DEF.)*/\n...\nPROCLIB=00, /* USE //PROC00 DD (DEF.)*/ \n...\n\nPROCLIB data set that will be used in the access authorization process:\n\nSYS3.PROCLIB\nSYS2.PROCLIB \nSYS1.PROCLIB \n\nThe following PROCLIB data set will NOT be used or evaluated:\nSYS4.USERPROC\n\nRecommendation for sites:\n\nThe following are recommendations for the sites to ensure only PROCLIB data sets that contain the STC and TSO procedures are protected.\n\n- Remove all application PROCLIB data sets from MSTJCLxx and JES2 procedures. The customer will have all JCL changed to use the JCLLIB JCL statement to refer to the application PROCLIB data sets.\n\nExample:\n//USERPROC JCLLIB ORDER=(SYS4.USERPROC)\n\n- Remove all access to the application PROCLIB data sets and only authorize system programming personnel WRITE and/or greater access to these data sets.\n\n- Document the application PROCLIB data set access for the customers that require WRITE and/or greater access. Use this documentation as justification for the inappropriate access created by the scripts.\n\n- Change MSTJCLxx and JES2 procedure to identify STC and TSO PROCLIB data sets separate from application PROCLIB data sets. The following is a list of actions that can be performed to accomplish this recommendation:\n\na. Ensure that MSTJCLxx contains only PROCLIB data sets that contain STC and TSO procedures.\nb. If an application PROCLIB data set is required for JES2, ensure that the JES2 procedure specifies more than one PROCxx DD statement concatenation or identified in the JES2 dynamic PROCLIB definitions. Identify one PROCxx DD statement data set concatenation that contains the STC and TSO PROCLIB data sets. Identify one or more additional PROCxx DD statements that can contain any other PROCLIB data sets. The concatenation of the additional PROCxx DD statements can contain the same data sets that are identified in the PROCxx DD statement for STC and TSO. The following is an example of the JES2 procedure:\n\n//JES2 PROC \n//IEFPROC EXEC PGM=HASJES20,PARM=NOREQ, \n//DPRTY=(15,15),TIME=1440,PERFORM=9 \n//ALTPARM DD DISP=SHR, \n//DSN=SYS1.PARMLIB(JES2BKUP) \n//HASPPARM DD DISP=SHR, \n//DSN=SYS1.PARMLIB(JES2PARM) \n//PROC00 DD DSN=SYS3.PROCLIB,DISP=SHR \n//DD DSN=SYS2.PROCLIB,DISP=SHR\n//DD DSN=SYS1.PROCLIB,DISP=SHR \n//PROC01 DD DSN=SYS4.USERPROC,DISP=SHR \n//DD DSN=SYS3.PROCLIB,DISP=SHR \n//DD DSN=SYS2.PROCLIB,DISP=SHR \n//DD DSN=SYS1.PROCLIB,DISP=SHR \n//IEFRDER DD SYSOUT=* \n//HASPLIST DD DDNAME=IEFRDER\n\nc. Ensure that the JES2 configuration file is changed to specify that the PROCLIB entry for the STC and TSU JOBCLASSes point to the proper PROCxx entry within the JES2 procedure or JES2 dynamic PROCLIB definitions that contain the STC and/or TSO procedures. All other JOBCLASSes can specify a PROCLIB entry that uses the same PROCxx or any other PROCxx DD statement identified in the JES2 procedure or identified in the JES2 dynamic PROCLIB definitions. The following is an example of the JES2 initialization parameters:\n\nJOBCLASS(*) ACCT=NO, /* ACCT # NOT REQUIRED (DEF.)*/ \n...\nPROCLIB=01, /* DEFAULT TO //PROC01 DD (DEF.)*/\n...\nJOBCLASS(STC) AUTH=ALL, /* ALLOW ALL COMMANDS (DEF.)*/ \n...\nPROCLIB=00, /* USE //PROC00 DD (DEF.)*/ \n...\nJOBCLASS(TSU) AUTH=ALL, /* ALLOW ALL COMMANDS (DEF.)*/\n...\nPROCLIB=00, /* USE //PROC00 DD (DEF.)*/ \n...\n\nd. Ensure that only system programming personnel are authorized WRITE and/or greater access to PROCLIB data sets that contain STC and TSO procedures.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223688","ruleId":"SV-223688r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit access to System page data sets (i.e., PLPA, COMMON, and LOCALx) to system programmers.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Execute a dataset list of access for System page data sets (i.e., PLPA, COMMON, and LOCALx).\n\nIf ESM data set rules for system page data sets (PLPA, COMMON, and LOCAL) restrict access to only systems programming personnel, this is not a finding.\n\nIf ESM data set rules for system page data sets (PLPA, COMMON, and LOCAL) restrict auditors to READ only, this is not a finding.","fixText":"Configure the ESM data set rules for system page data sets (PLPA, COMMON, and LOCAL) to restrict access to only systems programming personnel.\nAuditors may be allowed READ Access as approved by the ISSM.","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223689","ruleId":"SV-223689r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected.","description":"MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.\n\nPreventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.\n\nPrivileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"Verify the CONSOLxx member of SYS1.PARMLIB.console is defined to RACF with a corresponding profile in the CONSOLE resource class.\n\nIf each console is defined to RACF with a corresponding profile in the CONSOLE resource class, this is not a finding.\n\nIf the userid associated with each console has READ access to the corresponding resource defined in the CONSOLE resource class, this is not a finding.\n\nIf access authorization for CONSOLE resources restricts READ access to operations and system programming personnel or authorized personnel, this is not a finding.","fixText":"Define all MCS consoles to the CONSOLE resource class and configure READ access to be limited to operators and system programmers.\n\nConfigure the MCS console resources defined to z/OS and the ESM to conform to those outlined below.\n\nEach console defined in the CONSOLxx parmlib member is defined to RACF with a corresponding profile in the CONSOLE resource class. See the IBM zOS OPERATIONS AND PLANNING guide for further information.\n\nEach CONSOLE profile is defined with UACC(NONE). \n\nExample:\nRDEF CONSOLE MMDMST UACC(NONE) OWNER(syspsmpl) \nRDEF CONSOLE MMD041 UACC(NONE) OWNER(syspsmpl) \nRDEF CONSOLE MMDSCN UACC(NONE) OWNER(syspsmpl)\nRDEF CONSOLE ** UACC(NONE) OWNER(syspsmpl) DATA(** represents all consoles not specifically defined)\n\nDo not permit any user or group access to the ** profile. If a new console is added to the CONSOLxx member it will be covered by this profile and a subsequent error will display in the log, which will allow identification of the undefined console.\n\nThe userid associated with each console will have READ access to the corresponding resource defined in the CONSOLE resource class. A sample command file to accomplish this is shown here:\n\nPE MMDMST CL(CONSOLE) ID(mmdmst)\nPE MMDSCN CL(CONSOLE) ID(mmdscn)\nPE MMD041 CL(CONSOLE) ID(mmd041)\n\nAccess authorization for CONSOLE resources restricts READ access to operations and system programming personnel or authorized personnel. A sample command file showing a permission of READ access for sysprogs and operators is shown here:\n\nPE MMDMST CL(CONSOLE) ID(syspsmpl opersmpl)\nPE MMDSCN CL(CONSOLE) ID(syspsmpl opersmpl)\nPE MMD041 CL(CONSOLE) ID(syspsmpl opersmpl)","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223690","ruleId":"SV-223690r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit WRITE or greater access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"The ESM data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) do not restrict WRITE or greater access to only z/OS systems programming personnel.\n\nThe ESM data set rules for the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) allow inappropriate access not documented and approved by ISSO.\n\nIf both of the above are untrue, this is not a finding.\n\nIf either of the above is true, this is a finding.","fixText":"Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect JES2 System datasets (spool, checkpoint, and parmlib datasets).\n\nConfigure WRITE or greater access to JES2 System datasets (spool, checkpoint, and parmlib datasets) to be limited to system programmers only. \n\nAccess other than this should be documented and approved by the ISSO (for example, all SYS1.HASP* data sets).","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223691","ruleId":"SV-223691r958726_rule","severity":"medium","ruleTitle":"The IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.","description":"Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges.","checkContent":"From the ISPF Command Shell enter: \nSearch all Class(Facility) MASK(ieasymup)\n\nFor each entity found enter: \nRL facility <entity>\n\nIf RACF resources are defined with a default access of NONE, this is not a finding.\n\nIf RACF resource access authorizations restrict UPDATE and/or greater access to appropriate personnel (i.e., DASD administrators, Tape Library personnel, and system programming personnel), this is not a finding.\n\nIf RACF resource logging requirements are specified for UPDATE and/or greater access, this is not a finding.","fixText":"Ensure that the System level symbolic resources are defined to the FACILITY resource class and protected. UPDATE access to the System level symbolic resources are limited to System Programmers, DASD Administrators, and/or Tape Library personnel. All access is logged. Ensure the guidelines for the resources and/or generic equivalent are followed.\n\nLimit access to the IEASYMUP resources to above personnel with UPDATE and/or greater access.\n\nThe following commands are provided as a sample for implementing resource controls:\n\nrdef facility ieasymup.* uacc(none) owner(admin) -\naudit(all(read)) -\ndata('protected per acp00350')\nrdef facility ieasymup.symbolname uacc(none) owner(admin) -\naudit(all(read)) -\ndata('protected per acp00350')\n\npe ieasymup.symbolname cl(facility) id(<dasdsmpl) acc(u)\npe ieasymup.symbolname cl(facility) id(<syspsmpl) acc(u)\npe ieasymup.symbolname cl(facility) id(<tapesmpl) acc(u)","ccis":["CCI-002235"]},{"vulnId":"V-223692","ruleId":"SV-223692r958730_rule","severity":"medium","ruleTitle":"The IBM RACF JES(BATCHALLRACF) SETROPTS value must be set to JES(BATCHALLRACF).","description":"In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations.\n\nSome programs and processes are required to operate at a higher privilege level and therefore should be excluded from the organization-defined software list after review.","checkContent":"From ISPF Command Shell enter: \nSETRopts List\n\nIf the JES(BATCHALLRACF) is enabled then the message \"JES-BATCHALLRACF OPTION IS ACTIVE\" will be displayed, this is not a finding.\n\nIf the message \"JES-BATCHALLRACF OPTION IS INACTIVE\" is displayed, this is a finding.","fixText":"Configure JES(BATCHALLRACF) SETROPTS value to be set to JES(BATCHALLRACF). This specifies that JES is to test for a userid and password on the job statement or for propagated RACF identification information for all batch jobs.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a status of JES BATCHALLRACF. \n\nJES BATCHALLRACF is activated with the command SETR JES(BATCHALLRACF).","ccis":["CCI-002233"]},{"vulnId":"V-223693","ruleId":"SV-223693r958730_rule","severity":"medium","ruleTitle":"The IBM z/OS JES(XBMALLRACF) SETROPTS value must be set to JES(XBMALLRACF).","description":"In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations.\n\nSome programs and processes are required to operate at a higher privilege level and therefore should be excluded from the organization-defined software list after review.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the JES(XBMALLRACF) is enabled then the message \"JES-XBMALLRACF OPTION IS ACTIVE\" will be displayed, this is not a finding.\n\nIf the message \"JES-XBMALLRACF OPTION IS INACTIVE\" is displayed, this is a finding.","fixText":"Configure JES(XBMALLRACF) SETROPTS value to be set to JES(XBMALLRACF). This specifies that JES is set to test for a userid and password on the job statement or for propagated RACF identification information for all jobs run under the execution batch monitor.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a status of JES-XBMALLRACF. \n\nXBMALLRACF is activated with the command SETR XBMALLRACF.","ccis":["CCI-002233"]},{"vulnId":"V-223694","ruleId":"SV-223694r958732_rule","severity":"medium","ruleTitle":"IBM RACF OPERAUDIT SETROPTS value must set to OPERAUDIT.","description":"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the OPERAUDIT value is listed as one of the ATTRIBUTES, this is not a finding.\n\nIf the OPERAUDIT value is not listed as one of the ATTRIBUTES, this is a finding.","fixText":"NOTE: The RACF AUDITOR attribute is required in order to specify SETROPTS OPERAUDIT and also to display the OPERAUDIT attribute with the SETROPTS LIST command.\n\nConfigure the OPERAUDIT SETROPTS value to be set to OPERAUDIT. This specifies that RACF logs all actions such as accesses to resources and commands for a user who has operations or group operations attribute.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ATTRIBUTES. \n\nLogging of all actions, such as accesses to resources and commands, allowed only because a user has the OPERATIONS or group-OPERATIONS attribute is activated with the command SETR OPERAUDIT.","ccis":["CCI-002234"]},{"vulnId":"V-223695","ruleId":"SV-223695r1050760_rule","severity":"medium","ruleTitle":"The IBM RACF PASSWORD(REVOKE) SETROPTS value must be specified to revoke the userid after three invalid logon attempts.","description":"By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the PASSWORD(REVOKE) value shows \"AFTER <n> CONSECUTIVE UNSUCCESSFUL PASSWORD ATTEMPTS, A USERID WILL BE REVOKED.\" where <n> is either \"1\" or \"2\", this is not a finding.\n\nIf the PASSWORD(REVOKE) value is not enabled and is not set to either \"1\" or \"2\", this is a finding.","fixText":"Ensure that PASSWORD(REVOKE) SETROPTS value is set to \"1\" or \"2\". This specifies the number of consecutive incorrect password attempts RACF allows before it revokes the USERID on the next incorrect attempt. If REVOKE is specified, ensure INITSTATS are in effect.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including PASSWORD REVOKE. \n\nSet the password REVOKE to \"2\" invalid attempts activated with the command SETR PASSWORD(REVOKE(2)).","ccis":["CCI-000044","CCI-002238"]},{"vulnId":"V-223697","ruleId":"SV-223697r998344_rule","severity":"high","ruleTitle":"IBM z/OS SYS1.PARMLIB must be properly protected.","description":"Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audits may degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nSYS1.PARMLIB contains the parameters that control audit configuration. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000063-GPOS-00032, SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125, SRG-OS-000337-GPOS-00129, SRG-OS-000362-GPOS-00149","checkContent":"Execute a dataset list of access to SYS1.PARMLIB.\n\nIf the ESM data set rules for SYS1.PARMLIB allow inappropriate (e.g., global READ) access, this is a finding.\n\nIf data set rules for SYS1.PARMLIB do not restrict READ, WRITE or greater access to only systems programming personnel, this is a finding.\n\nIf data set rules for SYS1.PARMLIB do not restrict READ and UPDATE access to only domain level security administrators, this is a finding.\n\nIf data set rules for SYS1.PARMLIB do not restrict READ access to only system Level Started Tasks, authorized Data Center personnel, and auditors, this is a finding.\n\nIf data set rules for SYS1.PARMLIB do not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged, this is a finding.","fixText":"Configure access rules for SYS1.PARMLIB as follows:\n\nSystems programming personnel will be authorized to WRITE or greater the SYS1.PARMLIB concatenation.\n\nDomain level security administrators can be authorized to update the SYS1.PARMLIB concatenation.\n\nSystem Level Started Tasks, authorized Data Center personnel, and auditor can be authorized read access by the information system security officer (ISSO).\n\nAll WRITE or greater access is logged.","ccis":["CCI-000171","CCI-000213","CCI-001499","CCI-003980","CCI-001914","CCI-002235"]},{"vulnId":"V-223699","ruleId":"SV-223699r991577_rule","severity":"medium","ruleTitle":"The IBM RACF SETROPTS SAUDIT value must be specified.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the SAUDIT value is listed as one of the ATTRIBUTES, this is not a finding.\n\nIf the NOSAUDIT value is listed as one of the ATTRIBUTES, this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nNote: that in order to set or list the SAUDIT value, the RACF AUDITOR attribute is required. Reference the documentation for the SETROPTS command in the RACF Command Language Reference. \n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for SAUDIT. \n\nSAUDIT is activated and set to the required value by issuing the command SETR SAUDIT.","ccis":["CCI-000172"]},{"vulnId":"V-223700","ruleId":"SV-223700r991556_rule","severity":"medium","ruleTitle":"The IBM RACF REALDSN SETROPTS value must be specified.","description":"Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.","checkContent":"From the ISPF Command Shell enter:\nSETRopts list\n\nIf the REALDSN is enabled then the message \"REAL DATA SET NAMES OPTION IS ACTIVE\" will be displayed, this is not a finding.\n\nIf the message \"REAL DATA SET NAMES OPTION IS INACTIVE\" is displayed, this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Configure control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for the REALDSN Option. \n\nREALDSN is ACTIVATED by issuing the command SETR REALDSN.","ccis":["CCI-001487"]},{"vulnId":"V-223701","ruleId":"SV-223701r958434_rule","severity":"medium","ruleTitle":"IBM z/OS must limit access for SMF collection files (i.e., SYS1.MANx) to appropriate users and/or batch jobs that perform SMF dump processing.","description":"SMF data collection is the system activity journaling facility of the z/OS system. Unauthorized access could result in the compromise of logging and recording of the operating system environment, ESM, and customer data.\n\nUnauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.\n\nAudit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity.\n\nSatisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000256-GPOS-00097, CCI-001494, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099, SRG-OS-000080-GPOS-00048, SRG-OS-000206-GPOS-00084, SRG-OS-000324-GPOS-00125","checkContent":"Refer to the SMFPRMxx member in SYS1.PARMLIB. Determine the SMF and/or Logstream dataset name.\n\nIf the following statements are true, this is not a finding.\n\nThe ESM data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict ALTER or greater access to only z/OS systems programming personnel.\n\nThe ESM data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict UPDATE or greater access to z/OS systems programming staff and/or batch jobs that perform SMF dump processing and others approved by the ISSM.\n\nThe ESM data set rules for the SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) restrict READ access to auditors and others approved by the ISSM.\n\nThe ESM data set rules for SMF data collection files (e.g., SYS1.MAN* or IFASMF.SYS1.*) specify that all (i.e., failures and successes) UPDATE and/or ALTER accesses are logged.","fixText":"Configure ALTER access to SMF collection files to be limited to only z/OS systems programming staff. \n\nConfigure UPDATE or greater access to z/OS system programming staff /or batch jobs that perform SMF dump processing. Access can be granted to others as determined by the ISSM.\n\nConfigure READ access to be limited to auditors. READ access may be granted to others as determined by the ISSM.\n\nAccess to other users specified must be documented in a security plan.\n\nEnsure the accesses are being logged.","ccis":["CCI-000162","CCI-000163","CCI-000164","CCI-000213","CCI-001314","CCI-001493","CCI-001494","CCI-001495","CCI-002235"]},{"vulnId":"V-223702","ruleId":"SV-223702r958796_rule","severity":"medium","ruleTitle":"IBM RACF SETROPTS RVARYPW values must be properly set.","description":"Failure to provide logical access restrictions associated with changes to system configuration may have significant effects on the overall security of the system.\n\nWhen dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the operating system can have significant effects on the overall security of the system.\n\nAccordingly, only qualified and authorized individuals should be allowed to obtain access to operating system components for the purposes of initiating changes, including upgrades and modifications.\n\nLogical access restrictions include, for example, controls that restrict access to workflow automation, media libraries, abstract layers (e.g., changes implemented into third-party interfaces rather than directly into information systems), and change windows (e.g., changes occur only during specified times, making unauthorized changes easy to discover).","checkContent":"From the ISPF Command Shell enter:\n\nSETROPTS LIST\n\nIf the \"INSTALLATION DEFINED RVARY PASSWORD IS IN EFFECT\" message for both the SWITCH and STATUS functions, this is not a finding.","fixText":"Configure RACF ensure that the RVARYPW passwords are specified and conform to password requirements documented in RACF0460. The ISSO will evaluate the impact associated with implementation of the control option and develop a plan of action to implement the control option as required.\n\nA sample command for setting both the SWITCH and STATUS passwords are shown here:\n\nSETR RVARYPW(SWITCH(Wxy$8Pqu) STATUS(pbZ0@wL2))","ccis":["CCI-001813"]},{"vulnId":"V-223703","ruleId":"SV-223703r991591_rule","severity":"high","ruleTitle":"IBM RACF must define WARN = NO on all profiles.","description":"Failure to restrict system access to authenticated users negatively impacts operating system security.","checkContent":"Review all Dataset and resource profiles in the RACF database.\n\nIf any are not defined with WARN = NO, this is a finding.","fixText":"Define each dataset and resource profile with WARN = NO","ccis":["CCI-000366"]},{"vulnId":"V-223704","ruleId":"SV-223704r991589_rule","severity":"high","ruleTitle":"The IBM RACF PROTECTALL SETROPTS value specified must be properly set.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the SETROPTS values for PROTECTALL is ACTIVE and set to FAIL, this is not a finding.\n\nIf the SETROPTS PROTECTALL parameter is set to NOPROTECTALL or PROTECTALL(WARNING), this is a finding.\n\nAdditional analysis may be required to determine whether this finding should be downgraded to a Category II or remain a Category I.\n\nExample of a Category I finding where not a further analysis is required:\n\nControl Options: SETROPTS NOPROTECTALL\n\nExample of a possible Category I finding requiring additional analysis:\n\nControl Options: SETROPTS PROTECTALL(WARNING)\n\nPROTECTALL(WARNING) allows access to a data set only if it is not at protected by a profile in the DATASET resource class. Therefore if all sensitive data sets are properly protected by profiles in the DATASET resource class, PROTECTALL(WARNING) will not at allow unauthorized access. This situation allows for a downgrade to a Category II.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for the PROTECTALL Option. \n\nPROTECTALL is ACTIVATED and set to FAIL by issuing the command SETR PROTECTALL(FAIL).","ccis":["CCI-000366"]},{"vulnId":"V-223705","ruleId":"SV-223705r991589_rule","severity":"medium","ruleTitle":"The IBM RACF GRPLIST SETROPTS value must be set to ACTIVE.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the GRPLIST is enabled then the message \"LIST OF GROUPS ACCESS CHECKING IS ACTIVE.\" will be displayed, this is not a finding.\n\nIf the message indicates that LIST OF GROUPS is NOT ACTIVE, this is a finding.","fixText":"Configure the GRPLIST SETROPTS value to be set to ACTIVE. \n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including a status of GRPLIST. \n\nList of Groups Checking is activated with the command SETR GRPLIST.","ccis":["CCI-000366"]},{"vulnId":"V-223706","ruleId":"SV-223706r991589_rule","severity":"medium","ruleTitle":"The IBM RACF RETPD SETROPTS value specified must be properly set.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the RETPD is enabled then the message \"SECURITY RETENTION PERIOD IN EFFECT IS NEVER-EXPIRES DAYS\" will be displayed, this is not a finding.\n\nIf the RETPD value is not set to \"NEVER-EXPIRES\", this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for the RETPD (Retention Period) Option. \n\nRETPD is activated and set to the required value by issuing the command SETR RETPD(99999).","ccis":["CCI-000366"]},{"vulnId":"V-223707","ruleId":"SV-223707r991589_rule","severity":"medium","ruleTitle":"The IBM RACF TAPEDSN SETROPTS value specified must be properly set.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the TAPEDSN is enabled then the message \"TAPE DATA SET PROTECTION IS ACTIVE\" will be displayed, this is not a finding.\n\nNOTE 1: TAPEDSN should be active for domains without a tape management product.\n\nNOTE 2: For domains running CA 1, Computer Associates recommends that TAPEDSN be active and CA 1 parameter OCEOV be set to OFF.\n\nIf the TAPEDSN value is set to INACTIVE, this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for the TAPEDSN Option. \n\nTAPEDSN is ACTIVATED by issuing the command SETR TAPEDSN.","ccis":["CCI-000366"]},{"vulnId":"V-223708","ruleId":"SV-223708r991589_rule","severity":"medium","ruleTitle":"The IBM RACF WHEN(PROGRAM) SETROPTS value specified must be active.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the WHEN(PROGRAM) value is listed as one of the ATTRIBUTES, this is not a finding.\n\nIf the NOWHEN(PROGRAM) value is listed as one of the ATTRIBUTES, this is a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including the value for the WHEN(PROGRAM) Option. \n\nWHEN(PROGRAM) is ACTIVATED by issuing the command SETR WHEN(PROGRAM).","ccis":["CCI-000366"]},{"vulnId":"V-223709","ruleId":"SV-223709r991589_rule","severity":"medium","ruleTitle":"IBM RACF use of the AUDITOR privilege must be justified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nListUser *\n\nIf authorization to the SYSTEM AUDITOR attribute is restricted to auditing and/or security personnel, this is not a finding.\n\nIf at minimum, any users connected to sensitive system dataset HLQ (e.g., SYS1, SYS2, etc.) groups or general resource owning groups with the Group-AUDITOR attribute are Auditor and/or Security personnel, this is not a finding.\n\nOtherwise, Group-AUDITOR is allowed.","fixText":"Review all USERIDs with the AU (Manual) - Review all USERIDs with the AUDITOR attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed.\n\nThe AUDITOR attribute is removed from a user with the command: ALU <userid> NOAUDITOR.\n\nTo remove the Group-Auditor attribute:\n\nCO <user> GROUP(<groupname>) NOAUDITOR","ccis":["CCI-000366"]},{"vulnId":"V-223710","ruleId":"SV-223710r991589_rule","severity":"medium","ruleTitle":"The IBM RACF database must be on a separate physical volume from its backup and recovery datasets.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Execute the RACDST report from DSMON Utility using 'RACF PRIMARY' and 'RACF BACKUP' as selection criteria.\n\nIf the security database and its backup exist on the same volume, this is a finding.","fixText":"Identify the ACP database(s), backup database(s), and recovery data set(s). Develop a plan to keep these data sets on different physical volumes. Implement the movement of these critical ACP files.","ccis":["CCI-000366"]},{"vulnId":"V-223711","ruleId":"SV-223711r991589_rule","severity":"medium","ruleTitle":"The IBM RACF database must be backed up on a scheduled basis.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Ask the system administrator to determine that procedures exist to back up the security data base and files. Have the system administrator identify the dataset names and frequency of the backups.\n\nIf, based on the information provided, it can be determined that the ESM database is being backed up on a regularly scheduled basis, this is not a finding.\n\nIf it cannot be determined that the ESM database is being backed up on a regularly scheduled basis, this is a finding.","fixText":"Develop procedures to back up all ACP files needed for recovery on a scheduled basis.\n\nIdentify the ACP database and ensure that documented processes are in place to back up its contents on a regularly scheduled basis.\n\nAt a minimum, this should include nightly backup of the ACP databases and of other critical security files (such as the ACP parameter file). More frequent backups (two or three times daily) will reduce the time necessary to effect recovery. The ISSO will verify that the backup job(s) run successfully.","ccis":["CCI-000366"]},{"vulnId":"V-223712","ruleId":"SV-223712r991589_rule","severity":"medium","ruleTitle":"IBM z/OS Batch job user IDs must be properly defined.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated user IDs.\n\nFrom the ISPF COMMAND INPUT screen enter:\nLISTUSER(each identified batch job)\n\nThe following USERID record fields/attributes must be specified:\n\nNAME\nPROTECTED\n\nNo USERID has the LAST-ACCESS field set to UNKNOWN.\n\nIf both of the above are true, this is not a finding.\n\nIf either of the USERID record fields/attributes (NAME and/or PROTECTED) are blank and/or the LAST ACCESS field is set to unknown, this is a finding.","fixText":"Ensure the following:\n\nAssociated USERIDs are defined for all batch jobs and documentation authorizing access to system resources is maintained and implemented.\n\nSet up the userids with the RACF PROTECTED attribute. A sample RACF command to accomplish is shown here: ALU <execution-userid> NOPASSWORD NOOIDCARD.","ccis":["CCI-000366"]},{"vulnId":"V-223713","ruleId":"SV-223713r991589_rule","severity":"medium","ruleTitle":"IBM RACF use of the RACF SPECIAL Attribute must be justified.","description":"The organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-secure.","checkContent":"From the ISPF Command Shell enter:\nListUser *\n\nIf authorization to the SYSTEM SPECIAL attribute is restricted to key systems personnel such as individuals responsible for continuing operations, Storage Management, and emergency recovery, this is not a finding.\n\nIf any users connected to sensitive system dataset HLQ (e.g., SYS1, SYS2, ETC) groups with the Group-SPECIAL are key systems personnel, such as individuals responsible for continuing operations, Storage Management, and emergency recovery, this is a finding.\n\nOtherwise, Group-SPECIAL is allowed.","fixText":"Review all USERIDs with the SPECIAL attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed.\n\nFor the SYSTEM SPECIAL attribute:\n\nA sample command for removing the SPECIAL attribute is shown here: ALU <userid> NOSPECIAL.\n\nFor the GROUP SPECIAL attribute:\n\nCO <user> GROUP(<groupname>) NOSPECIAL","ccis":["CCI-000366"]},{"vulnId":"V-223714","ruleId":"SV-223714r991589_rule","severity":"medium","ruleTitle":"IBM RACF assignment of the RACF OPERATIONS attribute to individual userids must be fully justified.","description":"This requirement is intended to cover both traditional interactive logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service-oriented architectures).","checkContent":"From the ISPF Command Shell enter:\nListUser *\n\nIf authorization to the SYSTEM OPERATIONS attribute is restricted to key systems personnel such as individuals responsible for continuing operations, Storage Management, and emergency recovery, this is not a finding.\n\nIf any users connected to sensitive system dataset HLQ (e.g., SYS1, SYS2, ETC) groups with the Group-OPERATIONS are key systems personnel, such as individuals responsible for continuing operations, Storage Management, and emergency recovery, this is a finding.\n\nOtherwise, Group-OPERATIONS is allowed.","fixText":"Review all USERIDs with the OPERATIONS attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed.\n\nA sample command to remove the OPERATIONS attribute from a userid is shown here: \n\nALU <userid> NOOPERATIONS\n\nTo remove the Group-Operations attribute:\n\nCO <user> GROUP(<groupname>) NOOPERATIONS","ccis":["CCI-000366"]},{"vulnId":"V-223715","ruleId":"SV-223715r958480_rule","severity":"medium","ruleTitle":"IBM z/OS must properly configure CONSOLxx members.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\n\nMCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"Review each CONSOLxx parmlib member. \n\nIf the following guidance is true, this is not a finding. \n\nThe \"DEFAULT\" statement for each CONSOLxx member specifies \"LOGON(REQUIRED)\" or \"LOGON(AUTO)\".\n\nThe \"CONSOLE\" statement for each console assigns a unique name using the \"NAME\" parameter.\n\nThe \"CONSOLE\" statement for each console specifies \"AUTH(INFO)\". Exceptions are the \"AUTH\" parameter is not valid for consoles defined with \"UNIT(PRT)\" and specifying \"AUTH(MASTER)\" is permissible for the system console.\n\nNote: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the \"DEFAULT\" statement requirement.","fixText":"Configure the \"DEFAULT\" statement to specify \"LOGON(REQUIRED)\" so that all operators are required to log on prior to entering z/OS system commands. At the discretion of the ISSO, \"LOGON(AUTO)\" may be used. If \"LOGON(AUTO)\" is used assure that the console userids are defined with minimal access. See ACP00292.\n\nConfigure each \"CONSOLE\" statement to specify an explicit console NAME. And that \"AUTH(INFO)\" is specified, this also including extended MCS consoles. \"AUTH(MASTER)\" may be specified for systems console.\n\nNote: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the \"DEFAULT\" statement requirement.","ccis":["CCI-000382"]},{"vulnId":"V-223716","ruleId":"SV-223716r958480_rule","severity":"medium","ruleTitle":"IBM z/OS must properly protect MCS console userid(s).","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\n\nMCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"Refer to IEASYS00 to determine correct CONSOLxx member. \n\nExamine the CONSOLxx member.\n\nVerify that the MCS console userids are properly restricted. \n\nIf the following guidance is true, this is not a finding.\n\nEach console defined in the currently active CONSOLxx parmlib member in EXAM.RPT(PARMLIB) is associated with a valid RACF userid.\n\nEach console userid has no special privileges and/or attributes (e.g., SPECIAL, OPERATIONS, etc.).\nEach console userid has no accesses to interactive on-line facilities (e.g., TSO, CICS, etc.; excluding VTAM SMCS consoles).\n\nEach console userid will be restricted from accessing all data sets and resources except MVS.MCSOPER.consolename in the OPERCMDS resource class and console name in the CONSOLE resource class.\n\nEach console userid has the RACF default group that is an appropriate console group profile.\n\n\nNOTE:\tIf LOGON(AUTO) is specified in the currently active CONSOLxx parmlib member, additional access may be required. Permissions for the console userids and/or console group may be given with access READ to MVS.CONTROL, MVS.DISPLAY, MVS.MONITOR, and MVS.STOPMN OPERCMDS resource.\n\nNOTE:\tExecute the JCL in CNTL(IRRUT100) using the RACF console userids as SYSIN input. This report lists all occurrences of these userids within the RACF database, including data set and resource access lists.","fixText":"Define all consoles identified in the currently active CONSOLxx parmlib member in EXAM.RPT(PARMLIB) to be defined to RACF.\n\nReview the MCS console resources defined to z/OS and RACF, and ensure they conform to those outlined below.\n\nEach console defined in the currently active CONSOLxx parmlib member in EXAM.RPT(PARMLIB) is associated with a valid RACF userid.\n\nEach console userid has no special privileges and/or attributes (e.g., SPECIAL, OPERATIONS, etc.).\n\nEach console userid has no accesses to interactive on-line facilities (e.g., TSO, CICS, etc.; excluding VTAM SMCS consoles).\n\nEach console userid will be restricted from accessing all data sets and resources except MVS.MCSOPER.consolename in the OPERCMDS resource class and consolename in the CONSOLE resource class.\n\nEach console userid has the RACF default group that is an appropriate console group profile.\n\nNOTE: If LOGON(AUTO) is specified in the currently active CONSOLxx parmlib member, additional access may be required. Permissions for the console userids and/or console group may be given with access READ to MVS.CONTROL, MVS.DISPLAY, MVS.MONITOR, and MVS.STOPMN OPERCMDS resource.\n\nNOTE: Execute the JCL in CNTL(IRRUT100) using the RACF console userids as SYSIN input. This report lists all occurrences of these userids within the RACF database, including data set and resource access lists.\n\nExamples: \nAG consautolog SUPGROUP(<syspsmpl>) OWNER(<syspsmpl>) -\nDATA(' group for console userids for autolog processing ')\n\nAG consnoautolog SUPGROUP(<syspsmpl>) OWNER(<syspsmpl>) -\nDATA('group for console userids for no autolog processing')\n\nAU consname NAME('CONSOLE USERID FOR consname') NOPASSWORD NOOIDCARD -\nDFLTGRP(consautolog) OWNER(consautolog) -\nDATA('ADDED TO SUPPORT THE CHANGE TO LOGON(AUTO) IN CONSOLXX')\n\nPERMIT MVS.CONTROL.** CL(OPERCMDS) ID(consautolog) ACCESS(READ)\nPERMIT MVS.DISPLAY.** CL(OPERCMDS) ID(consautolog) ACCESS(READ)\nPERMIT MVS.MONITOR.** CL(OPERCMDS) ID(consautolog) ACCESS(READ)\nPERMIT MVS.STOPMN.** CL(OPERCMDS) ID(consautolog) ACCESS(READ)\n\nPERMIT consname CL(CONSOLE) ID(consname)","ccis":["CCI-000382"]},{"vulnId":"V-223717","ruleId":"SV-223717r958482_rule","severity":"medium","ruleTitle":"IBM RACF users must have the required default fields.","description":"Ensure that Every USERID is uniquely identified to the system. Within the USERID record, the user's name, default group, the owner, and the user's passdate or phrasedate fields are completed. This will uniquely identify each user. If these fields are not completed for each user, user accountability will become lost.","checkContent":"From a z/OS command screen enter:\nListUser *\n\nExamine each user entry verify every user is fully identified with all of the following conditions:\n-A completed NAME field that can either be traced back to a current DD2875 or a Vendor Requirement (example: A Started Task). \n-The presence of the DEFAULT-GROUP and OWNER fields. \n-The PASSDATE field or the PHRASEDATE field accordingly is not set to N/A excluding users with the PROTECTED attribute. \n\nIf all of the above are true, this is not a finding. \n\nIf any of above is untrue, this is a finding.","fixText":"Review all USERID definitions to ensure required information is provided. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes listed in this PDI. The following are sample commands to correct this vulnerability.\n\n-To Add a NAME to a userid with the command ALU <userid> NAME('lastname, firstname').\n-Every user will be assigned a default group by default. A sample command to reassign a default group is shown here: ALU <userid> DFLTGRP(<newdefaultgroup>). You must first be connected to a group via the RACF CONNECT command before making it a default group.\n-A PASSDATE field or a PHRASEDATE field showing 00.000 indicates that a temporary password or password phrase has been assigned but the user has not logged in and set a permanent value. This could indicate that a new userid was recently added or that a userid previously added is unused and should be considered for deletion. The ISSO should investigate and determine if the userid should be deleted or that the new user should be contacted and told to login to set a permanent value.","ccis":["CCI-000764"]},{"vulnId":"V-223719","ruleId":"SV-223719r958482_rule","severity":"medium","ruleTitle":"IBM z/OS Started Tasks must be properly identified and defined to RACF.","description":"Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources.\n\nTo ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.","checkContent":"Refer to the site security plan, the system administrator, and system libraries to determine list of stated tasks available on the system.\n\nIf each Started task procedure identified has a unique associated userid or STC userid that is unique per product and function, this is not a finding.\n\nIf any of the following are untrue, this is a finding.\n\n-All started task userids are connected to a valid STC group ID.\n-Only userids associated with STCs are connected to STC group IDs.\n-All STC userids are defined with the PROTECTED attribute.\n\nFrom the ISPF Command Shell enter:\nRL STARTED (Alternately execute RACF DSMON utility for the RACSPT report)\n\nIf all of the following is true, this is not a finding,\n\nIf any of the following is untrue, this is a finding.\n\n-A generic catch all profile of ** is defined to the STARTED resource class.\n-The STC group associated with the ** profile is not granted any explicit data set or resource access authorizations.\n-The STC userid associated with the ** profile is not granted any explicit dataset or resource access authorizations and is defined with the RESTRICTED attribute.\n\nNote: Execute the JCL in CNTL(IRRUT100) using the STC group associated with the ** profile as SYSIN input. This report lists all occurrences of this group within the RACF database, including data set and resource access lists.\n\nExecute RACF utility DSMON RACSPT report.\n\nIf the ICHRIN03 started procedures table is not maintained to support recovery efforts in the event the STARTED resource class is deactivated or critical STC profiles are deleted, this is a finding.\n\nIf STCs critical to support this recovery effort (e.g., JES2, VTAM, TSO, etc.) are not maintained in ICHRIN03 to reflect the current STARTED resource class profiles, this is a finding.","fixText":"Define a RACF STARTED Class profile for each Started Proc that maps the proc to a unique userid, or STC userids will be unique per product and function if supported by vendor documentation. This can be accomplished with the sample command:\nRDEF STARTED <procname>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER(<userid>) GROUP(<groupname>) TRACE(YES))\n\nA corresponding USERID must be defined with appropriate authority. The \"groupname\" should be a valid STC group with no interactive users.","ccis":["CCI-000764"]},{"vulnId":"V-223721","ruleId":"SV-223721r958482_rule","severity":"medium","ruleTitle":"The IBM RACF Automatic Data Set Protection (ADSP) SETROPTS value must be set to NOADSP.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"From the ISPF Command Shell enter:\nSETROPTS LIST\n\nIf the ADSP value is NOT IN EFFECT, this is not a finding.\n\nNote: NOADSP is the required setting. In the SETROPTS LIST output this will display as AUTOMATIC DATASET PROTECTION IS NOT IN EFFECT.\n\nIf the ADSP value is IN EFFECT, this is a finding.","fixText":"Configure ADSP SETROPTS value to be set to NOADSP.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nNOADSP is set with the command SETR NOADSP.","ccis":["CCI-000764"]},{"vulnId":"V-223722","ruleId":"SV-223722r998345_rule","severity":"medium","ruleTitle":"IBM RACF user accounts must uniquely identify system users.","description":"To assure individual accountability and prevent unauthorized access, organizational users must be individually identified and authenticated.\n\nA group authenticator is a generic account used by multiple individuals. Use of a group authenticator alone does not uniquely identify individual users. Examples of the group authenticator is the UNIX OS \"root\" user account, the Windows \"Administrator\" account, the \"sa\" account, or a \"helpdesk\" account.\n\nFor example, the UNIX and Windows operating systems offer a \"switch user\" capability allowing users to authenticate with their individual credentials and, when needed, switch to the administrator role. This method provides for unique individual authentication prior to using a group authenticator.\n\nUsers (and any processes acting on behalf of users) need to be uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the operating system without identification or authentication.\n\nRequiring individuals to be authenticated with an individual authenticator prior to using a group authenticator allows for traceability of actions, as well as adding an additional level of protection of the actions that can be taken with group account knowledge.\n\nSatisfies: SRG-OS-000104-GPOS-00051, SRG-OS-000109-GPOS-00056, SRG-OS-000125-GPOS-00065, SRG-OS-000121-GPOS-00062","checkContent":"Obtain a list of all userids that are shared among multiple users (i.e., not uniquely identified system users).\n\nIf there are no shared userids on this domain, this is not a finding.\n\nIf there are shared userids on this domain, this is a finding.","fixText":"Identify user accounts defined to the ESM that are being shared among multiple users. This may require interviews with appropriate system-level support personnel. Remove the shared user accounts from the ESM.","ccis":["CCI-000764","CCI-004045","CCI-000804","CCI-000877"]},{"vulnId":"V-223723","ruleId":"SV-223723r998346_rule","severity":"medium","ruleTitle":"The IBM RACF INACTIVE SETROPTS value must be set to 35 days.","description":"Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained.\n\nOperating systems need to track periods of inactivity and disable application identifiers after 35 days of inactivity.","checkContent":"From a z/OS command input screen enter:\nList SETRopts\n\nIf the INACTIVE value is set properly In the message \"INACTIVE USERIDS ARE BEING AUTOMATICALLY REVOKED AFTER xxx DAYS.\", where xxx is a value \"35\" or less, this is not a finding.","fixText":"Configure the INACTIVE SETROPTS value to a value that is \"35\" or less. INACTIVE specifies the number of days that a USERID can remain unused and still be considered valid.","ccis":["CCI-003627"]},{"vulnId":"V-223724","ruleId":"SV-223724r998347_rule","severity":"medium","ruleTitle":"IBM RACF PASSWORD(RULEn) SETROPTS value(s) must be properly set.","description":"The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.\n\nPassword complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.\n\nSatisfies: SRG-OS-000069-GPOS-00037, SRG-OS-000078-GPOS-00046","checkContent":"From the ISPF Command Shell enter:\nSETRopts\n\nIf the following options are specified, this is not a finding.\n\nEvery PASSWORD(RULE) under \"INSTALLATION PASSWORD SYNTAX RULES\" is defined with the values shown below:\n\nRULE n LENGTH(8) xxxxxxxx\n\nThe following options are in effect under \"PASSWORD PROCESSING OPTIONS\":\n\n\"MIXED CASE PASSWORD SUPPORT IS IN EFFECT\"\n\"SPECIAL CHARACTERS ARE ALLOWED.\"","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nFor z/OS release 1.13 and 1.14 PTF UA90720 must be applied.\nFor z/OS Release 2.1 PTF UA90721 must be applied.\n\nThe RACF Command SETR LIST will show the status of RACF Controls including PASSWORD SYNTAX RULEs.\n\nSetting the password syntax to all Mixed Case Alphanumeric and Special Characters is activated with the commands:\n\nsetr password(mixedcase)\nsetr password(specialchars)\nsetr password(rulen(length(8) mixedall(1:8))","ccis":["CCI-004065","CCI-004066"]},{"vulnId":"V-223725","ruleId":"SV-223725r998349_rule","severity":"medium","ruleTitle":"IBM RACF exit ICHPWX01 must be installed and properly configured.","description":"Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nSatisfies: SRG-OS-000070-GPOS-00038, SRG-OS-000071-GPOS-00039, SRG-OS-000072-GPOS-00040, SRG-OS-000266-GPOS-00101, SRG-OS-000480-GPOS-00225","checkContent":"From a system console screen, issue the following modify command:\nF AXR,IRRPWREX LIST\n\nReview the results of the modify command. \n\nIf the following options are listed, this is not a finding.\n\n-The number of required character types is 4\n(ensures that at least one uppercase, one lowercase, one number, and one special character is used in password)\n\n-The user's name cannot be contained in the password.\n(Only three consecutive characters of the user's name are allowed)\n\n-The minimum word length checked is eight.\n\n-The user ID cannot be contained in the password.\n(Only three consecutive characters of the user ID are allowed)\n\n-Only three unchanged positions of the current password are allowed.\n(These positions need to be consecutive to cause a failure and this check is not case sensitive)\n\n-No more than zero pairs of repeating characters are allowed.\n(This check is not case sensitive)\n\n-A minimum list of 33 restricted prefix strings is being checked:\nAPPL APR AUG ASDF BASIC CADAM DEC DEMO FEB FOCUS GAME IBM JAN JUL\nJUN LOG MAR MAY NET NEW NOV OCT PASS ROS SEP SIGN SYS TEST TSO\nVALID VTAM XXX 1234\n\nIf the modify command fails or returns the following message in the system log, this is a finding.\n\nIRX0406E REXX exec load file REXXLIB does not contain exec member IRRPWREX.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nFor z/OS release 1.12 through z/OS release 2.1 APARs OA43998 and OA43999 must be applied.\n\nInstall exit IRRPWREX according to the following guidelines:\nREXX Parameter Setting\nSTIG_Compliant 'yes' \nPwd_minlen 8\nnumbers '0123456789'\nLower_letters 'abcdefghijklmnopqrstuvwxyz'\nUpper_letters 'ABCDEFGHIJKLMNOPQRSTUVWXYZ'\nspecial '$@#.<+|&!*-%_>?:'\nPwd_allowed_chars numbers||Upper_letters||special\nPwd_req_types 4\nPwd_name_allowed 'no'\nPwd_name_minlen 8\nPwd_name_chars 4\nPwd_min_unique 3\nPwd_min_unique_upper 'yes'\nPwd_max_unchanged 3\nPwd_max_unchanged_upper 'yes'\nPwd_max_unchanged_consecutive 'yes'\nPwd_all_unique 'no'\nPwd_no_consecutive 'no'\nPwd_no_consecutive_upper 'yes'\nPwd_min_new 4\nPwd_userID_allowed 'no'\nPwd_userID_chars 4\nPwd_repeat_chars 0\nPwd_repeat_upper 'yes'\nPwd_dict.0 8 /* Change this as words are added and deleted */\nPwd_dict.1 'IBM'\nPwd_dict.2 'RACF'\nPwd_dict.3 'PASSWORD'\nPwd_dict.4 'PHRASE'\nPwd_dict.5 'SECRET'\nPwd_dict.6 'IBMUSER'\nPwd_dict.7 'SYS1'\nPwd_dict.8 '12345678'\nPwd_dict.9 '99999999'\nPwd_prefix.0 33 /* Change this as values are added and deleted\nPwd_prefix.1 'APPL'\nPwd_prefix.2 'APR'\nPwd_prefix.3 'AUG'\nPwd_prefix.4 'ASDF'\nPwd_prefix.5 'BASIC'\nPwd_prefix.6 'CADAM'\nPwd_prefix.7 'DEC'\nPwd_prefix.8 'DEMO'\nPwd_prefix.9 'FEB'\nPwd_prefix.10 'FOCUS'\nPwd_prefix.11 'GAME'\nPwd_prefix.12 'IBM'\nPwd_prefix.13 'JAN'\nPwd_prefix.14 'JUL'\nPwd_prefix.15 'JUN'\nPwd_prefix.16 'LOG'\nPwd_prefix.17 'MAR'\nPwd_prefix.18 'MAY'\nPwd_prefix.19 'NET'\nPwd_prefix.20 'NEW'\nPwd_prefix.21 'NOV'\nPwd_prefix.22 'OCT'\nPwd_prefix.23 'PASS'\nPwd_prefix.24 'ROS'\nPwd_prefix.25 'SEP'\nPwd_prefix.26 'SIGN'\nPwd_prefix.27 'SYS'\nPwd_prefix.28 'TEST'\nPwd_prefix.29 'TSO'\nPwd_prefix.30 'VALID'\nPwd_prefix.31 'VTAM'\nPwd_prefix.32 'XXX'\nPwd_prefix.33 '1234'\n\nNote: RACF exit ICHPWX01 is coded to call a System REXX named IRRPWREX, so the name cannot be changed without a corresponding change to ICHPWX01.\n\nSystem REXX requires that this exec (IRRPWREX) reside in the REXXLIB concatenation.\n\nUpdate parameters in IRRPWREX according to table Parameters for RACF IRRPWREX as listed above.","ccis":["CCI-004066"]},{"vulnId":"V-223726","ruleId":"SV-223726r998350_rule","severity":"medium","ruleTitle":"The IBM RACF SETROPTS PASSWORD(MINCHANGE) value must be set to 1.","description":"Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually change their password, then the password could be repeatedly changed in a short period of time to defeat the organization's policy regarding password reuse.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the PASSWORD(MINCHANGE) value shows PASSWORD MINIMUM CHANGE INTERVAL IS <1> DAYS, this is not a finding.","fixText":"Configure PASSWORD(MINCHANGE) SETROPTS value number to \"1\". This specifies the number of days that must pass before a user can change their password.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including PASSWORD MINCHANGE. Use the following command as an example command:\nSETROPTS PASSWORD(MINCHANGE(1))","ccis":["CCI-004066"]},{"vulnId":"V-223727","ruleId":"SV-223727r1038967_rule","severity":"medium","ruleTitle":"IBM RACF SETROPTS PASSWORD(INTERVAL) must be set to 60 days.","description":"Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the operating system does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the operating system passwords could be compromised. INTERVAL specifies the maximum number of days that each user's password is valid. When a user logs on to the system, RACF compares the system password interval value specified in the user profile. RACF uses the lower of the two values to determine if the users password has expired.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the PASSWORD(INTERVAL) value is set properly and the message is PASSWORD CHANGE INTERVAL IS 060 DAYS, this is not a finding.","fixText":"Configure PASSWORD(INTERVAL) SETROPTS value to \"060\" days. This specifies the maximum number of days that each user's password is valid.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including PASSWORD INTERVAL. \n\nSetting the password interval to 60 days is activated with the command SETR PASSWORD(INTERVAL(60)).","ccis":["CCI-004066"]},{"vulnId":"V-223728","ruleId":"SV-223728r998354_rule","severity":"medium","ruleTitle":"The IBM RACF PASSWORD(HISTORY) SETROPTS value must be set to five or more.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the PASSWORD(HISTORY) value is set properly then the message x GENERATIONS OF PREVIOUS PASSWORDS BEING MAINTAINED, where x is a minimum of \"5\", this is not a finding.","fixText":"Configure the PASSWORD(HISTORY) SETROPTS value is set to a minimum of \"5\". This specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETR LIST will show the status of RACF Controls including PASSWORD HISTORY. \n\nSetting the password history to 10 generations is activated with the command SETR PASSWORD(HISTORY(10)).","ccis":["CCI-004061"]},{"vulnId":"V-223729","ruleId":"SV-223729r998355_rule","severity":"high","ruleTitle":"NIST FIPS-validated cryptography must be used to protect passwords in the security database.","description":"Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nOperating systems utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. \n\nSatisfies: SRG-OS-000073-GPOS-00041, SRG-OS-000074-GPOS-00042, SRG-OS-000120-GPOS-00061","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nIf the following is specified under PASSWORD PROCESSING OPTIONS: THE ACTIVE PASSWORD ENCRYPTION ALGORITHM IS KDFAES, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified below:\n\nFor z/OS release 1.12 through z/OS release 2.1 APARs OA43998 and OA43999 must be applied.\n\nSet the passwords option for algorithm to KDFAES.\n\nSample syntax to activate:\nSETRopts PASSWORD(ALGORITHM(KDFAES))","ccis":["CCI-004062","CCI-000197","CCI-000803"]},{"vulnId":"V-223731","ruleId":"SV-223731r1137695_rule","severity":"medium","ruleTitle":"The IBM RACF ERASE ALL SETROPTS value must be set to ERASE(ALL) on all systems.","description":"Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection.\n\nThis requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DoD or other government agencies.\n\nThere may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.","checkContent":"From the ISPF Command Shell enter:\nSETRopts List\n\nFor all systems, if the ERASE values are set as follows, this is not a finding. \n\nERASE-ON-SCRATCH IS ACTIVE, CURRENT OPTIONS: \nERASE-ON-SCRATCH FOR ALL DATA SETS IS IN EFFECT","fixText":"Configure the ERASE SETROPTS value to ERASE(ALL) this allows DASD datasets to be erased when deleted.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\n-Issue the RACF Command SETR LIST to show the status of RACF Controls including the status of the ERASE options.\n\n-Take the appropriate actions to ensure that the SETR ERASE(ALL) has been issued to enable Erase On Scratch for all datasets.","ccis":["CCI-001090"]},{"vulnId":"V-223732","ruleId":"SV-223732r1137691_rule","severity":"medium","ruleTitle":"IBM RACF DASD Management USERIDs must be properly controlled.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"This applies to non-SMS volumes. For SMS-Managed volumes this is Not Applicable.\n\nAsk the system administrator for all documents and procedures that apply to Storage Management, including identification of the DASD backup data sets and associated storage management userids.\n\nFrom the ISPF Command enter:\nRL User for each identified Userid.\n\nReview storage management userids, if the following guidance is true, this is not a finding.\n\nStorage management userids will not be given the \"OPERATIONS\" attribute.\n\nStorage management userids will be defined with the \"PROTECTED\" attribute.\n\nStorage management userids are permitted to the appropriate \"STGADMIN\" profiles in the \"FACILITY\" class for SMS-managed volumes.\n\nStorage management userids assigned to storage management tasks (e.g., volume backup, data set archive and restore, etc.) are given access to data sets using \"DASDVOL\" and/or \"GDASDVOL\" profiles for non-SMS-managed volumes.\n\nNOTE: \"DASDVOL\" profiles will not work with SMS-managed volume. \"FACILITY\" class profiles must be used instead. If \"DFSMS/MVS\" is used to perform DASD management operations, \"FACILITY\" class profiles may also be used to authorize storage management operations to non-SMS-managed volumes in lieu of using \"DASDVOL\" profiles. Therefore, not all volumes may be defined to the \"DASDVOL/GDASDVOL\" resource classes, and not all storage management userids may be represented in the profile access lists.","fixText":"Note: This applies to non-SMS volumes. Refer to the System Managed Storage group (i.e., ZSMSnnnn) for requirements for System managed Storage.\nEvaluate the impact of accomplishing the change. Develop a plan of action and implement the change as required.\n\nEnsure that storage management userids do not possess the \"OPERATIONS\" attribute. A sample command to accomplish this is shown here: \n\nALU <userid> NOOPERATIONS\n\nEnsure that storage management userids possess the \"PROTECTED\" attribute. A sample command to accomplish this is shown here: \n\nALU <userid> NOPASS NOOIDCARD\n\nEnsure that storage management userids are permitted to the appropriate \"STGADMIN\" profiles in the \"FACILITY\" class for SMS-managed volumes.\n\nEnsure that storage management userids are permitted to appropriate \"DASDVOL\" profiles for non-SMS-managed volumes.","ccis":["CCI-000213"]},{"vulnId":"V-223733","ruleId":"SV-223733r958406_rule","severity":"medium","ruleTitle":"IBM z/OS SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.","description":"The FTP Server can provide audit data in the form of SMF records. The SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.\n\nSatisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000392-GPOS-00172","checkContent":"If FTPDATA is configured with the following SMF statements, this is not a finding.\n\nFTP.DATA Configuration Statements\nSMF TYPE119\nSMFJES TYPE119\nSMFSQL TYPE119\nSMFAPPE [Not coded or commented out]\nSMFDEL [Not coded or commented out]\nSMFEXIT [Not coded or commented out]\nSMFLOGN [Not coded or commented out]\nSMFREN [Not coded or commented out]\nSMFRETR [Not coded or commented out]\nSMFSTOR [Not coded or commented out]","fixText":"Configure SMF options to conform to the specifications in the FTPDATA Configuration Statements below:\n\nSMF TYPE119\nSMFJES TYPE119\nSMFSQL TYPE119\nSMFAPPE [Not coded or commented out]\nSMFDEL [Not coded or commented out]\nSMFEXIT [Not coded or commented out]\nSMFLOGN [Not coded or commented out]\nSMFREN [Not coded or commented out]\nSMFRETR [Not coded or commented out]\nSMFSTOR [Not coded or commented out]\n\nThe FTP Server can provide audit data in the form of SMF records. SMF record type 119, the TCP/IP Statistics record, can be written with the following subtypes:\n\n70 - Append\n70 - Delete and Multiple Delete\n72 - Invalid Logon Attempt\n70 - Rename\n70 - Get (Retrieve) and Multiple Get\n70 - Put (Store and Store Unique) and Multiple Put\n\nSMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. This data may provide valuable information for security audit activities. Type 119 records use a more standard format and provide more information.","ccis":["CCI-000067","CCI-002884"]},{"vulnId":"V-223734","ruleId":"SV-223734r1137691_rule","severity":"medium","ruleTitle":"IBM RACF permission bits and user audit bits for HFS objects that are part of the FTP server component must be properly configured.","description":"MVS data sets of the FTP Server provide the configuration and operational characteristics of this product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of customer data and some system services.","checkContent":"From the ISPF Command Shell enter:\nomvs\n\nAt the input line enter:\ncd /usr/sbin/\nenter\nls -alW\n\nIf the following File permission and user Audit Bits are true, this is not a finding.\n\n/usr/sbin/ftpd 1740 fff\n/usr/sbin/ftpdns 1755 fff\n/usr/sbin/tftpd 0644 faf\ncd \nls -alW\n\nIf the following file permission and user Audit Bits are true, this is not a finding.\n\n/etc/ftp.data 0744 faf\n/etc/ftp.banner 0744 faf\n\nNOTES: Some of the files listed above are not used in every configuration. The absence of a file is not considered a finding.\n\nThe /usr/sbin/ftpd and /usr/sbin/ftpdns objects are symbolic links to /usr/lpp/tcpip/sbin/ftpd and /usr/lpp/tcpip/sbin/ftpdns respectively. The permission and user audit bits on the targets of the symbolic links must have the required settings.\n\nThe /etc/ftp.data file may not be the configuration file the server uses. It is necessary to check the SYSFTPD DD statement in the FTP started task JCL to determine the actual file.\n\nThe TFTP Server does not perform any user identification or authentication, allowing any client to connect to the TFTP Server. Due to this lack of security, the TFTP Server will not be used. The TFTP Client is not secured from use. The permission bits for /usr/sbin/tftpd should be set to 644.\n\nThe /etc/ftp.banner file may not be the banner file the server uses. It is necessary to check the BANNER statement in the FTP Data configuration file to determine the actual file. Also, the permission bit setting for this file must be set as indicated in the table above. A more restrictive set of permissions is not permitted.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"With the assistance of a systems programmer with UID(0) and/or SUPERUSER access, configure the UNIX permission bits and user audit bits on the HFS directories and files for the FTP Server to conform to the specifications in the table below:\n\nFTP Server HFS Object Security Settings\nFile Permission Bits User Audit Bits\n/usr/sbin/ftpd 1740 fff\n/usr/sbin/ftpdns 1755 fff\n/usr/sbin/tftpd 0644 faf\n/etc/ftp.data 0744 faf\n/etc/ftp.banner 0744 faf\n\nThe /usr/sbin/ftpd and /usr/sbin/ftpdns objects are symbolic links to /usr/lpp/tcpip/sbin/ftpd and /usr/lpp/tcpip/sbin/ftpdns respectively. The permission and user audit bits on the targets of the symbolic links must have the required settings.\n\nThe TFTP Server does not perform any user identification or authentication, allowing any client to connect to the TFTP Server. Due to this lack of security, the TFTP Server will not be used. The TFTP Client is not secured from use.\n\nThe /etc/ftp.data file may not be the configuration file the server uses. It is necessary to check the SYSFTPD DD statement in the FTP started task JCL to determine the actual file.\n\nThe /etc/ftp.banner file may not be the banner file the server uses. It is necessary to check the BANNER statement in the FTP Data configuration file to determine the actual file.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nSome of the files listed above (e.g., /etc/ftp.data) are not used in every configuration. While the absence of a file is generally not a security issue, the existence of a file that has not been properly secured can often be an issue. Therefore, all files that do exist should have the specified permission and audit bit settings.\n\nThe following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 1740 /usr/lpp/tcpip/sbin/ftpd\nchaudit rwx=f /usr/lpp/tcpip/sbin/ftpd\nchmod 1755 /usr/lpp/tcpip/sbin/ftpdns\nchaudit rwx=f /usr/lpp/tcpip/sbin/ftpdns\nchmod 0744 /etc/ftp.data\nchaudit w=sf,rx+f /etc/ftp.data\nchmod 0744 /etc/ftp.banner\nchaudit w=sf,rx+f /etc/ftp.banner","ccis":["CCI-000213"]},{"vulnId":"V-223735","ruleId":"SV-223735r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS data sets for the FTP server must be properly protected.","description":"MVS data sets of the FTP Server provide the configuration and operational characteristics of this product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of customer data and some system services.","checkContent":"Refer to the FTP server Started task (usually FTPD). Refer to the dataset defined on the SYSFTPD DD statement.\n\nIf WRITE and ALLOCATE access to the data set containing the FTP Data configuration file is restricted to systems programming personnel, this is not a finding.\n\nNote: READ access to all authenticated users is permitted.\n\nIf WRITE and ALLOCATE access to the data set containing the FTP Data configuration file is logged, this is not a finding.\n\nIf WRITE and ALLOCATE access to the data set containing the FTP banner file is restricted to systems programming personnel, this is not a finding.\n\nNote: READ access to the data set containing the FTP banner file is permitted to all authenticated users.\n\nNotes: The MVS data sets mentioned above are not used in every configuration. Absence of a data set will not be considered a finding. The data set containing the FTP Data configuration file is determined by checking the SYSFTPD DD statement in the FTP started task JCL. The data set containing the FTP banner file is determined by checking the BANNER statement in the FTP Data configuration file.","fixText":"Review the data set access authorizations defined to the ACP for the FTP.DATA and FTP.BANNER files. Configure these data sets to be protected as follows:\n\nThe data set containing the FTP.DATA configuration file allows read access to all authenticated users and all other access is restricted to systems programming personnel.\n\nAll Write and Allocate access to the data set containing the FTP.DATA configuration file is logged.\n\nThe data set containing the FTP banner file allows read access to all authenticated users and all other access is restricted to systems programming personnel.","ccis":["CCI-000213"]},{"vulnId":"V-223736","ruleId":"SV-223736r958390_rule","severity":"medium","ruleTitle":"IBM z/OS FTP.DATA configuration statements must indicate a BANNER statement with the proper content.","description":"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreem't.\"\n\nSatisfies: SRG-OS-000023-GPOS-00006, SRG-OS-000024-GPOS-00007","checkContent":"Refer to the FTP.DATA file specified on the SYSFTPD DD statement in the FTP started task JCL. The SYSFTPD DD statement is optional.\n\nThe search order for FTP.DATA is: \n/etc/ftp.data \nSYSFTPD DD statement \njobname.FTP.DATA \nSYS1.TCPPARMS(FTPDATA) \ntcpip.FTP.DATA \n\nExamine the BANNER statement.\n\nEnsure the BANNER statement in the FTP Data configuration file specifies an HFS file or data set that contains a logon banner with the Standard Mandatory DoD Notice and Consent Banner. The below banner is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. The thrust of this new policy is to make it clear that there is no expectation of privacy when using DoD information systems and all use of DoD information systems is subject to searching, auditing, inspecting, seizing, and monitoring, even if some personal use of a system is permitted:\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nIf the BANNER statement in the FTP Data configuration file does not specify an HFS file or z/OS data set that contains the Standard Mandatory DoD Notice and Consent Banner, this is a finding.","fixText":"Ensure the BANNER statement in the FTP Data configuration file specifies an HFS file or z/OS data set that contains a logon Standard Mandatory DoD Notice and Consent Banner. The below banner is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. The thrust of this new policy is to make it clear that there is no expectation of privacy when using DoD information systems and all use of DoD information systems is subject to searching, auditing, inspecting, seizing, and monitoring, even if some personal use of a system is permitted:\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.","ccis":["CCI-000048","CCI-000050"]},{"vulnId":"V-223737","ruleId":"SV-223737r958586_rule","severity":"medium","ruleTitle":"IBM z/OS FTP.DATA configuration statements for the FTP server must specify the BANNER statement.","description":"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreem't.\"","checkContent":"Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.\n\nIf the BANNER statement is coded, this is not a finding.","fixText":"Configure the FTP configuration to include the BANNER statement.","ccis":["CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"]},{"vulnId":"V-223739","ruleId":"SV-223739r991589_rule","severity":"medium","ruleTitle":"IBM z/OS FTP.DATA configuration statements for the FTP Server must be specified in accordance with requirements.","description":"This requirement is intended to cover both traditional interactive logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service-oriented architectures).","checkContent":"Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.\n\nIf the UMASK statement is coded with a value of 077, this is not a finding.","fixText":"Configure the FTP configuration to include the UMASK statement with a value of 077. \n\nIf the FTP Server requires a UMASK value less restrictive than 077, requirements should be justified and documented with the ISSO.","ccis":["CCI-000366"]},{"vulnId":"V-223741","ruleId":"SV-223741r958480_rule","severity":"medium","ruleTitle":"IBM z/OS user exits for the FTP server must not be used without proper approval and documentation.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.\n\nSeveral user exit points in the FTP Server component are available to permit customization of its operating behavior. These exits can be used to modify functions such as FTP command usage, client connection controls, post processing tasks, and SMF record modifications. Without proper review and adequate documentation of these exit programs, undesirable operations and degraded security may result. This exposure could lead to unauthorized access impacting data integrity or the availability of some system services, or contribute to the loss of accountability and hamper security audit activities.","checkContent":"Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.\n\nRefer to the file(s) allocated by the STEPLIB DD statement in the FTP started task JCL.\n\nRefer to the libraries specified in the system Linklist and LPA.\n\nIf any FTP Server exits are in use, identify them and validate that they were reviewed for integrity and approved by the site AO.\n\nIf the following items are in effect for FTP Server user exits, this is not a finding:\n\nThe FTCHKCMD, FTCHKIP, FTCHKJES, FTCHKPWD, FTPSMFEX, and FTPOSTPR modules are not located in the FTP daemon's STEPLIB, Linklist, or LPA.\n\nNOTE: The ISPF ISRFIND utility can be used to search the system Linklist and LPA for specific modules.","fixText":"Review the configuration statements in the FTP.DATA file. Review the FTP daemon STEPLIB, system Linklist, and Link Pack Area libraries. If FTP Server exits are enabled or present, and have not been approved by the site ISSM and not securely written and implemented by the site systems programmer, they should not be installed. Verify that none of the following exits are installed unless they have met the requirements listed above:\nFTCHKCMD\nFTCHKIP\nFTCHKJES\nFTCHKPWD\nFTPOSTPR\nFTPSMFEX","ccis":["CCI-000382"]},{"vulnId":"V-223742","ruleId":"SV-223742r958482_rule","severity":"medium","ruleTitle":"The IBM z/OS FTP server daemon must be defined with proper security parameters.","description":"The FTP Server daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the FTP Server daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.","checkContent":"From z/OS command screen enter: \nListUser FTPD OMVS (FTPD is usual name of the FTP daemon)\n\nIf all of the following are true, this is not a finding.\n\nIf either of the following is untrue, this is a finding.\n\n-The FTPD userid is defined as a PROTECTED userid.\n-The FTPD userid has the following z/OS UNIX attributes: UID(0), HOME directory '/', shell program /bin/sh.\n\nFrom z/OS command screen enter:\nRList STARTED FTPD\n\nIf a matching entry in the STARTED resource class exists enabling the use of the standard userid and appropriate group, this is not a finding.","fixText":"Define the FTP daemon userid and a matching entry in the STARTED resource class enabling the use of the standard userid and an appropriate group. \n\nDefine the FTPD userid as a PROTECTED userid. \n\nDefine the FTPD userid with the following z/OS UNIX attributes: UID(0), HOME directory '/', shell program /bin/sh. \n\nSample commands to accomplish these requirements are shown here:\nAdd the FTPD userid:\n\nAU FTPD NAME('STC, FTP Daemon') NOPASSWORD NOOIDCARD DFLTGRP(STCTCPX) OWNER(STCTCPX) OMVS(UID(0) HOME('/') PROGRAM('/bin/sh'))\n\nRDEF STARTED FTPD.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER(=MEMBER) GROUP(STCTCPX) TRACE(YES))\n\nAdditional permissions may be required. See SYS1.TCPIP.SEZAINST(EZARACF) or IBM Comm Server: IP Config Guide.","ccis":["CCI-000764"]},{"vulnId":"V-223743","ruleId":"SV-223743r970703_rule","severity":"medium","ruleTitle":"IBM FTP.DATA configuration for the FTP server must have the INACTIVE statement properly set.","description":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element. \n\nTerminating network connections associated with communications sessions includes, for example, de-allocating associated TCP/IP address/port pairs at the operating system level, and de-allocating networking assignments at the application level if multiple application sessions are using a single operating system-level network connection. This does not mean that the operating system terminates all sessions or network access; it only ends the inactive session and releases the resources associated with that session.","checkContent":"Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.\n\nIf the INACTIVE statement is coded with a value between 1 and 900 (seconds), this is not a finding.","fixText":"Configure the FTP configuration to include an Inactive statement with a value between 1 and 900 (seconds).","ccis":["CCI-001133"]},{"vulnId":"V-223744","ruleId":"SV-223744r970703_rule","severity":"medium","ruleTitle":"IBM z/OS startup parameters for the FTP server must have the INACTIVE statement properly set.","description":"To address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.","checkContent":"Refer to the FTPD started task procedure.\n\nIf the SYSTCPD and SYSFTPD DD statements specify the TCP/IP Data and FTP Data configuration files respectively, this is not a finding.\n\nIf the ANONYMOUS keyword is not coded on the PARM parameter on the EXEC statement, this is not a finding.\n\nIf the ANONYMOUS=logonid combination is not coded on the PARM parameter on the EXEC statement, this is not a finding.\n\nIf the INACTIVE keyword is not coded on the PARM parameter on the EXEC statement, this is not a finding.","fixText":"Review the FTP daemon's started task JCL. Ensure that the ANONYMOUS and INACTIVE startup parameters are not specified and configuration file names are specified on the appropriate DD statements.\n\nThe FTP daemon program can accept parameters in the JCL procedure that is used to start the daemon. The ANONYMOUS and ANONYMOUS= keywords are designed to allow anonymous FTP connections. The INACTIVE keyword is designed to set the timeout value for inactive connections. Control of these options is recommended through the configuration file statements rather than the startup parameters.\n\nThe systems programmer responsible for supporting ICS will ensure that the startup parameters for the FTP daemon does not include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords.\n\nDuring initialization the FTP daemon searches multiple locations for the TCPIP.DATA and FTP.DATA files according to fixed sequences. In the daemon's started task JCL, Data Definition (DD) statements will be used to specify the locations of the files. The SYSTCPD DD statement identifies the TCPIP.DATA file and the SYSFTPD DD statement identifies the FTP.DATA file.\n\nThe systems programmer responsible for supporting ICS will ensure that the FTP daemon's started task JCL specifies the SYSTCPD and SYSFTPD DD statements for configuration files.","ccis":["CCI-000804","CCI-001133"]},{"vulnId":"V-223745","ruleId":"SV-223745r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS RJE workstations and NJE nodes must be defined to the FACILITY resource class.","description":"Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"Refer to SYS1.PARMLIB (JES2PARM)\nFor each node entry\n\nIf all JES2 defined NJE nodes and RJE workstations have a profile defined in the FACILITY resource class, this is not a finding.\n\nNotes: Nodename is the NAME parameter value specified on the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.\nWorkstation is RMTnnnn, where nnnn is the number on the RMT statement. Review the JES2 parameters for RJE workstation definitions by searching for RMT( in the report.\nNJE.* and RJE.* profiles will force userid and password protection of all NJE and RJE connections respectively. This method is acceptable in lieu of using discrete profiles.","fixText":"Configure associated PROFILEs TO exist for all RJE/NJE sources and review the authorizations for these remote facilities.","ccis":["CCI-000213"]},{"vulnId":"V-223746","ruleId":"SV-223746r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 input sources must be controlled in accordance with the proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"Refer the JES2PARM member of SYS1.PARMLIB.\n\nReview the following resources in the RACF JESINPUT resource class:\n\nINTRDR (internal reader for batch jobs)\nnodename (NJE node)\nOFFn.* (spool offload receiver)\nRnnnn (RJE workstation)\nRDRnn (local card reader)\nSTCINRDR (internal reader for started tasks)\nTSUINRDR (internal reader for TSO logons)\n\nNote: If any of the following are not defined within the JES2 parameters, the resource in the JESINPUT resource class does not have to be defined.\n\n-Nodename is the NAME parameter in the NODE statement. Review the NJE node definitions by searching for NODE( in the report.\n-OFFn, where n is the number of the offload receiver. Review the spool offload receiver definitions by searching for OFF( in the report.\n-Rnnnn, where nnnn is the number of the remote workstation. Review the RJE node definitions by searching for RMT( in the report.\n-RDRnn, where nn is the number of the reader. Review the reader definitions by searching for RDR( in the report.\n\nIf the JESINPUT resource class is active, this is not a finding.\n\nIf the resources detailed above are protected by generic and/or fully qualified profiles defined to the JESINPUT resource class, this is not a finding.","fixText":"Review the following resources in the JESINPUT resource class:\n\nINTRDR (internal reader for batch jobs)\nnodename (NJE node)\nOFFn.* (spool offload receiver)\nRnnnn (RJE workstation)\nRDRnn (local card reader)\nSTCINRDR (internal reader for started tasks)\nTSUINRDR (internal reader for TSO logons)\n\nNote: If any of the following are not defined within the JES2 parameters, the resource in the JESINPUT resource class does not have to be defined.\n\n-Nodename is the NAME parameter in the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.\n-OFFn, where n is the number of the offload receiver. Review the JES2 parameters for spool offload receiver definitions by searching for OFF( in the report.\n-Rnnnn, where nnnn is the number of the remote workstation. Review the JES2 parameters for RJE node definitions by searching for RMT( in the report.\n-RDRnn, where nn is the number of the reader. Review the JES2 parameters for reader definitions by searching for RDR( in the report.\n\nDefine the JESINPUT resource class to the ACTIVE CLASSES in RACF SETROPTS.\n\nConfigure the resources detailed above to be protected by generic and/or fully qualified profiles defined to the JESINPUT resource class.\n\nExamples:\nsetr classact(jesinput) \nsetr generic(jesinput) \nrdef jesinput intrdr UACC(none) owner(admin) audit(failures(read) success(update)) data('Per SRR PDI ZJES0021') \npe intrdr cl(jesinput) id(<syspsmpl>)\npe intrdr cl(jesinput) id(*) /* all users */","ccis":["CCI-000213"]},{"vulnId":"V-223747","ruleId":"SV-223747r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 input sources must be properly controlled.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL JESINPUT *\n\nIf the RACF resources and/or generic equivalent identified below are defined with access restricted to the appropriate personnel, this is not a finding.\n\nINTRDR\nnodename\nOFFn.*\nOFFn.JR\nOFFn.SR\nRnnnn.RDm\nRDRnn\nSTCINRDR\nTSUINRDR and/or TSOINRDR\n\nNote: Examples of appropriate might be access to the offload input sources is limited to systems personnel (e.g., operations staff) as directed by site operations and the site security plan.","fixText":"Configure access for resources defined to the JESINPUT resource class to restrict to the appropriate personnel.\n\nGrant read access to authorized users for each of the following input sources:\n\nINTRDR\nnodename\nOFFn.*\nOFFn.JR\nOFFn.SR\nRnnnn.RDm\nRDRnn\nSTCINRDR\nTSUINRDR and/or TSOINRDR\n\nThe resource definition will be generic if all of the resources of the same type have identical access controls (e.g., if all off load receivers are equivalent).","ccis":["CCI-000213"]},{"vulnId":"V-223748","ruleId":"SV-223748r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 output devices must be controlled in accordance with the proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"Refer the JES2PARM member of SYS1.PARMLIB.\n\nReview the following resources in the RACF WRITER resource class:\nJES2.** (backstop profile)\nJES2.LOCAL.OFFn.* (spool offload transmitter)\nJES2.LOCAL.OFFn.ST (spool offload SYSOUT transmitter)\nJES2.LOCAL.OFFn.JT (spool offload job transmitter)\nJES2.LOCAL.PRTn (local printer)\nJES2.LOCAL.PUNn (local punch)\nJES2.NJE.nodename (NJE node)\nJES2.RJE.Rnnnn.PRm (remote printer)\nJES2.RJE.Rnnnn.PUm (remote punch)\n\n-JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.\n-OFFn, where n is the number of the offload transmitter. Determine the numbers by searching for OFF( in the JES2 parameters.\n-PRTn, where n is the number of the local printer. Determine the numbers by searching for PRT( in the JES2 parameters.\n-PUNn, where n is the number of the local card punch. Determine the numbers by searching for PUN( in the JES2 parameters.\n-Nodename is the NAME parameter value specified on the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.\n-Rnnnn.PRm, where nnnn is the number of the remote workstation and m is the number of the printer. Determine the numbers by searching for .PR in the JES2 parameters.\n-Rnnnn.PUm, where nnnn is the number of the remote workstation and m is the number of the punch. Determine the numbers by searching for .PU in the JES2 parameters.\n\nIf the WRITER resource class is active, this is not a finding.\n\nIf the other resources detailed above are protected by generic and/or fully qualified profiles defined to the WRITER resource class with UACC(NONE), this is not a finding.","fixText":"Review the following resources in the WRITER resource class:\n\nJES2.** (backstop profile)\nJES2.LOCAL.OFFn.* (spool offload transmitter)\nJES2.LOCAL.OFFn.ST (spool offload SYSOUT transmitter)\nJES2.LOCAL.OFFn.JT (spool offload job transmitter)\nJES2.LOCAL.PRTn (local printer)\nJES2.LOCAL.PUNn (local punch)\nJES2.NJE.nodename (NJE node)\nJES2.RJE.Rnnnn.PRm (remote printer)\nJES2.RJE.Rnnnn.PUm (remote punch)\n\n-JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.\n-OFFn, where n is the number of the offload transmitter. Determine the numbers by searching for OFF( in the JES2 parameters.\n-PRTn, where n is the number of the local printer. Determine the numbers by searching for PRT( in the JES2 parameters.\n-PUNn, where n is the number of the local card punch. Determine the numbers by searching for PUN( in the JES2 parameters.\n-Nodename is the NAME parameter value specified on the NODE statement. Review the JES2 parameters for NJE node definitions by searching for NODE( in the report.\n-Rnnnn.PRm, where nnnn is the number of the remote workstation and m is the number of the printer. Determine the numbers by searching for .PR in the JES2 parameters.\n-Rnnnn.PUm, where nnnn is the number of the remote workstation and m is the number of the punch. Determine the numbers by searching for .PU in the JES2 parameters.\n\nDefine the WRITER resource class to the ACTIVE CLASSES in RACF SETROPTS.\n\nConfigure the profile JES2.** to have no access in the WRITER resource class.\n\nConfigure the resources detailed above to be protected by generic and/or fully qualified profiles defined to the WRITER resource class. \n\nExamples:\nsetr classact(writer) \nsetr gencmd(writer) generic(writer) \nsetr raclist(writer) \nRDEF WRITER JES2.** owner(admin) AUDIT(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.LOCAL.** owner(admin) AUDIT(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.LOCAL.OFF*.JT owner(admin) audit(ALL) UACC(NONE) -\ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.LOCAL.OFF*.ST owner(admin) audit(ALL) UACC(NONE) -\ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.LOCAL.PRT* owner(admin) audit(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.LOCAL.PUN* owner(admin) audit(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.NJE.** owner(admin) audit(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \nRDEF WRITER JES2.RJE.** owner(admin) audit(ALL) UACC(NONE) - \ndata('Reference SRR PDI ZJES0031') \n\npe JES2.** cl(writer) id(<syspsmpl>) \npe JES2.LOCAL.** cl(writer) id(<syspsmpl>) \npe JES2.LOCAL.OFF*.JT cl(writer) id(<syspsmpl>) \npe JES2.LOCAL.OFF*.ST cl(writer) id(<syspsmpl>) \npe JES2.LOCAL.PRT* cl(writer) id(<syspsmpl>) \npe JES2.LOCAL.PUN* cl(writer) id(<syspsmpl>) \npe JES2.NJE.** cl(writer) id(<syspsmpl>) \npe JES2.RJE.** cl(writer) id(<syspsmpl>) \nsetr racl(writer) Ref","ccis":["CCI-000213"]},{"vulnId":"V-223749","ruleId":"SV-223749r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 output devices must be properly controlled for classified systems.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL WRITER *\n\nIf the RACF resources and/or generic equivalent identified below are defined with access restricted to the appropriate personnel, this is not a finding.\n\nJES2.LOCAL.devicename\nJES2.LOCAL.OFFn.*\nJES2.LOCAL.OFFn.JT\nJES2.LOCAL.OFFn.ST\nJES2.LOCAL.PRTn\nJES2.LOCAL.PUNn\nJES2.NJE.nodename\nJES2.RJE.devicename\n\nNote: Examples of appropriate restriction might be access to the offload input sources is limited to systems personnel (e.g., operations staff) as directed by site operations and the site security plan.","fixText":"Configure access authorization for resources defined to the WRITER resource class to be restricted to the operators and system programmers on a classified system only.\n\nDefine resources in the ACP's respective WRITER class for each of the following output destinations:\n\nJES2.LOCAL.devicename\nJES2.LOCAL.OFFn.*\nJES2.LOCAL.OFFn.JT\nJES2.LOCAL.OFFn.ST\nJES2.LOCAL.PRTn\nJES2.LOCAL.PUNn\nJES2.NJE.nodename\nJES2.RJE.devicename","ccis":["CCI-000213"]},{"vulnId":"V-223750","ruleId":"SV-223750r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JESSPOOL resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nSETRopt list\n\nIf the JESSPOOL resource class is active, this is not a finding.","fixText":"Configure the JESSPOOL resource class to be active:\n\nUse the RACF Command: SETROPTS CLASSACT(JESSPOOL).","ccis":["CCI-000213"]},{"vulnId":"V-223751","ruleId":"SV-223751r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JESNEWS resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL OPERCMS *\n\nJES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.\n\nIf the JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class, this is not a finding. \n\nIf access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts CONTROL access to the appropriate personnel (i.e., users responsible for maintaining the JES News data set), this is not a finding.\n\nIf all access to the JES2.UPDATE.JESNEWS resource is logged, this is not a finding.","fixText":"Refer to \"Protecting JESNEWS\" in Chapter 7 of the JES2 Init & Tuning Guide.\n\na) Ensure the following items are in effect:\n\n1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of NONE and all access is logged.\n\nNOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.\n\n2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts CONTROL access to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged.\n\nExamples of setting up proper protection are shown here:\n\nRDEF OPERCMDS JES2.UPDATE.JESNEWS UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('COMPLY WITH ZJES0042')\n\nPERMIT JES2.UPDATE.JESNEWS CLASS(OPERCMDS) ID(<syspsmpl>) ACCESS(CONTROL)","ccis":["CCI-000213"]},{"vulnId":"V-223752","ruleId":"SV-223752r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JESTRACE and/or SYSLOG resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"Refer to the JESPARM member of SYS1.PARMLIB.\n\nReview the JES2 parameters to determine the localnodeid by searching for OWNNODE in the NJEDEF statement, and then searching for NODE(nnnn) (where nnnn is the value specified by OWNNODE). The NAME parameter value specified on this NODE statement is the localnodeid. Another method is to issue the JES2 command $D NODE,NAME,OWNNODE=YES to obtain the NAME of the OWNNODE.\n\nFrom the ISPF Command Shell enter:\nRL JESSPOOL *\nReview the following resources defined to the JESSPOOL resource class:\n\nlocalnodeid.JES2.$TRCLOG.taskid.*.JESTRACE\nlocalnodeid.+MASTER+.SYSLOG.jobid.*.SYSLOG or\nlocalnodeid.+BYPASS+.SYSLOG.jobid.-.SYSLOG\n\nNOTE: These resource profiles may be more generic as long as they pertain directly to the JESTRACE and SYSLOG data sets. For example:\n\nlocalnodeid.JES2.*.*.*.JESTRACE\nlocalnodeid.+MASTER+.*.*.*.SYSLOG or\nlocalnodeid.+BYPASS+.*.*.*.SYSLOG\n\nIf Userid(s) associated with external writer(s) have complete access, this is not a finding.\n\nNote: An external writer is an STC that removes data sets from the JES spool. In this case, it is responsible for archiving the JESTRACE and SYSLOG data sets. The STC default name is XWTR and the external writer program is called IASXWR00.\n\nIf Systems personnel and security administrators responsible for diagnosing JES2 and z/OS problems have complete access, this is not a finding.\n\nIf Application Development and Application Support personnel responsible for diagnosing application problems have READ access to the SYSLOG resource, this is not a finding.","fixText":"Configure RACF access authorization for resources defined to the JESTRACE and SYSLOG resources in the JESSPOOL resource class to be restricted to the appropriate personnel a detailed below.\n\nReview the following resources defined to the JESSPOOL resource class:\n\nlocalnodeid.JES2.$TRCLOG.taskid.*.JESTRACE\nlocalnodeid.+MASTER+.SYSLOG.jobid.*.SYSLOG or\nlocalnodeid.+BYPASS+.SYSLOG.jobid.*.SYSLOG\n\nNote: These resource profiles may be more generic as long as they pertain directly to the JESTRACE and SYSLOG data sets. For example:\n\nlocalnodeid.JES2.$TRCLOG.*.**\nlocalnodeid.+MASTER+.SYSLOG.*.** or\nlocalnodeid.+BYPASS+.SYSLOG.*.**\n\nNote: Review the JES2 parameters to determine the localnodeid by searching for OWNNODE in the NJEDEF statement, and then searching for NODE(nnnn) (where nnnn is the value specified by OWNNODE). The NAME parameter value specified on this NODE statement is the localnodeid. Another method is to issue the JES2 command $D NODE,NAME,OWNNODE=YES to obtain the NAME of the OWNNODE.\n\nEnsure that access authorization for the resources mentioned above is restricted to the following:\n\nUserid(s) associated with external writer(s) can have complete access.\n\nNote: An external writer is a STC that removes data sets from the JES spool. In this case, it is responsible for archiving the JESTRACE and SYSLOG data sets. The STC default name is XWTR and the external writer program is called IASXWR00. \n\nSystems personnel and security administrators responsible for diagnosing JES2 and z/OS problems can have complete access.\n\nApplication Development and Application Support personnel responsible for diagnosing application problems can have READ access to the SYSLOG resource.\n\nExamples:\nRDEFINE JESSPOOL localnodeid.JES2.$TRCLOG.*.** audit(failures(read)) UACC(none) -\ndata('Reference srr finding ZJES0044 ') owner(admin)\n\nRDEFINE JESSPOOL localnodeid.+MASTER+.SYSLOG.*.** audit(failures(read)) UACC(none) -\ndata('Reference srr finding ZJES0044') owner(admin)\nor\nRDEFINE JESSPOOL localnodeid.+BYPASS+.SYSLOG.*.** audit(failures(read)) UACC(none) -\ndata('Reference srr finding ZJES0044') owner(admin)\n\nPE localnodeid.JES2.$TRCLOG.** cl(jesspool) id(<syspsmpl> <secasmpl>) acc(a)\nPE localnodeid.+MASTER+.SYSLOG.*.** cl(jesspool) id(<syspsmpl> <secasmpl>) acc(a)\nPE localnodeid.+MASTER+.SYSLOG.*.** cl(jesspool) id(<appdpsmpl> <appssmpl>) acc(r)\nor\nPE localnodeid.+BYPASS+.SYSLOG.*.** cl(jesspool) id(<syspsmpl> <secasmpl>) acc(a)\nPE localnodeid.+BYPASS+.SYSLOG.*.** cl(jesspool) id(<appdpsmpl> <appssmpl>) acc(r)","ccis":["CCI-000213"]},{"vulnId":"V-223753","ruleId":"SV-223753r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 spool resources must be controlled in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL JESSPOOL *\n\nReview the accesses to the JESSPOOL resources. \n\nIf the following guidance is true, this is not a finding.\n\nReview the JESSPOOL report for resource permissions with the following naming convention. These profiles may be fully qualified, be specified as generic, or be specified with masking as indicated below:\n\nlocalnodeid.userid.jobname.jobid.dsnumber.name\n\nlocalnodeid The name of the node on which the SYSIN or SYSOUT data set currently resides.\nuserid The userid associated with the job. This is the userid RACF uses for validation purposes when the job runs.\njobname The name that appears in the name field of the JOB statement.\njobid The job number JES2 assigned to the job.\ndsnumber The unique data set number JES2 assigned to the spool data set. A D is the first character of this qualifier.\nname The name of the data set specified in the DSN= parameter of the DD statement. If the JCL did not specify DSN= on the DD statement that creates the spool data set, JES2 uses a question mark (?).\n\nAll users have access to their own JESSPOOL resources.\n\nThe localnodeid. resources are restricted to only system programmers, operators, and automated operations personnel with access of ALTER. All access will be logged. (localnodeid. resource includes all generic and/or masked permissions, example: localnodeid.**, localnodeid.*, etc.)\n\nThe JESSPOOL localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, can be made available to users when approved by the ISSO. Access will be identified at the minimum access for the user to accomplish the users function. UPDATE, CONTROL, and ALTER access will be logged. An example is team members within a team, providing the capability to view, help, and/or debug other team member jobs/processes.\n\nCSSMTP will be restricted to localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, when approved by the ISSO. All access will be logged.\n\nSpooling products users (CA-SPOOL, CA View, etc.) will be restricted to localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, when approved by the ISSO. Logging of access is not required.","fixText":"Configure accesses for JESSPOOL resources as detailed below. The JESSPOOL may have more restrictive security at the direction of the ISSO.\n\nThe JESSPOOL resources may be fully qualified, be specified as generic, or be specified with masking as indicated below:\n\nlocalnodeid.userid.jobname.jobid.dsnumber.name\n\nlocalnodeid The name of the node on which the SYSIN or SYSOUT data set currently resides.\n\nuserid The userid associated with the job. This is the userid used for validation purposes when the job runs.\n\njobname The name that appears in the name field of the JOB statement.\n\njobid The job number JES2 assigned to the job.\n\ndsnumber The unique data set number JES2 assigned to the spool data set. A D is the first character of this qualifier.\n\nname The name of the data set specified in the DSN= parameter of the DD statement. If the JCL did not specify DSN= on the DD statement that creates the spool data set, JES2 uses a question mark (?).\n\nBy default a user has access only to that user's own JESSPOOL resources. However, situations exist where a user legitimately requires access to jobs that run under another user's userid. In particular, if a user routes SYSOUT to an external writer, the external writer should have access to that user's SYSOUT. \n\nThe localnodeid. resource will be restricted to only system programmers, operators, and automated operations personnel with access of ALTER. All access will be logged. (localnodeid. resource includes all generic and/or masked permissions, example: localnodeid.**, localnodeid.*, etc.)\n\nRDEF JESSPOOL localnodeid.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('PROTECT JESSPOOL AT HIGH LEVEL, REF ZJES0046')\nPE localnodeid.** CL(JESSPOOL) ID(syspsmpl) ACC(A)\n\nThe JESSPOOL localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, can be made available to users when approved by the ISSO. Access will be identified at the minimum access for the user to accomplish the users function, SERVICE(READ, UPDATE, DELETE, ADD). All access will be logged. An example is team members within a team, providing the capability to view, help, and/or debug other team member jobs/processes. If frequent situations occur where users working on a common project require selective access to each other's jobs,  the installation may delegate to the individual users the authority to grant access, but only with the approval of the ISSO.\n\nRDEF JESSPOOL localnode.userid.jobname.jobid.dsnumber.name -\nUACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) -\nDATA('PROTECT JESSPOOL, REF ZJES0046')\nPE localnode.userid.jobname.jobid.dsnumber.name CL(JESSPOOL) ID(<users_or_groups>) ACC(R)\n\nIf IBM's SDSF product is installed on the system, resources defined to the JESSPOOL resource class control functions related to jobs, output groups, and SYSIN/SYSOUT data sets on various SDSF panels.\n\nCSSMTP will not be granted to the JESSPOOL resource of the high-level \"node.\" or \"localnodeid.\". CSSMTP can have access to the specific approved JESSPOOL resources, minimally qualified to the node.userid. and all access will be logged. This will ensure system records who (userid) sent traffic to CSSMTP, when, and what job/process.\n\nSpooling products users (CA-SPOOL, CA View, etc.) will be restricted to localnodeid.userid.jobname.jobid.dsnumber.name, whether generic and/or masked, when approved by the ISSO. Logging of access is not required.\n\nConduct a review of JESSPOOL resource rules. If a rule has been determined not to have been used within the last two years, the rule must be removed.","ccis":["CCI-000213"]},{"vulnId":"V-223754","ruleId":"SV-223754r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS JES2 system commands must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRList OPERCMDS *\n\nIf the JES2.** resource is defined to the OPERCMDS class with an access of NONE and all access is logged, this is not a finding.\n\nIf access to JES2 system commands defined in the IBM z/OS JES2 Commands is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users), as determined in the documented site Security Plan, this is not a finding.\n\nIf access to specific JES2 system commands is logged as indicated in the documented site Security Plan, this is not a finding.\n\nNote: Display commands and others as deemed by the site IAW site security plan may be allowed for all users with no logging.","fixText":"Extended MCS support allows the installation to control the use of JES2 system commands through the ESM. These commands are subject to various types of potential abuse. For this reason, it is necessary to place restrictions on the JES2 system commands that can be entered by particular operators.\n\nSome commands are particularly dangerous and should only be used when less drastic options have been exhausted. Misuse of these commands can create a situation in which the only recovery is an IPL.\n\nTo control access to JES2 system commands, apply the following:\nimplementing security:\n\nDefine the JES2.** resource in the OPERCMDS class with an access of NONE and all access is logged.\n\nDefine the JES2 system commands as specified in the IBM z/OS JES2 Commands to be restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users), as determined in the documented site Security Plan.\n\nDefine the JES2 system commands with proper logging as determined in the documented site Security Plan.\n\nNote: Display commands and others as deemed by the site IAW site security plan may be allowed for all users with no logging. \n\nBuild a command file based on the referenced JES2 Command Table. A sample of the commands in the command file is provided here:\n\nRDEF OPERCMDS JES2.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED BY SRR PDI ZJES0052')\n\nRDEF OPERCMDS JES2.<command>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED BY SRR PDI ZJES0052')\nPE JES2.<command>.** CL(OPERCMDS) ID(<syspsmpl>) ACC(U)\n\nSETR RACL(OPERCMDS) REF","ccis":["CCI-000213"]},{"vulnId":"V-223755","ruleId":"SV-223755r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS surrogate users must be controlled in accordance with proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000326-GPOS-00126","checkContent":"From the ISPF Command Shell enter:\nRList SURROGAT *\n\nIf no executionuserid.SUBMIT resources are defined to the SURROGAT resource class, this is Not Applicable.\n\nFor each executionuserid.SUBMIT resource defined to the SURROGAT resource class, if the following items are in true regarding surrogate controls, this is not a finding.\n\n-All executionuserid.SUBMIT resources defined to the SURROGAT resource class specify a default access of NONE.\n-All resource access is logged; at the discretion of the ISSM/ISSO scheduling tasks may be exempted.\n\nAccess authorization is restricted to scheduling tools, started tasks, or other system applications required for running production jobs.\n\nOther users may have minimal access required for running production jobs with documentation properly approved and filed with the site security official (ISSM or equivalent).","fixText":"Configure the SURROGAT as follows:\nFor executionuserid.SUBMIT resources defined to the SURROGAT resource class, ensure the following items are in effect regarding surrogate controls:\n\nAll executionuserid.SUBMIT resources defined to the SURROGAT resource class specify a default access of NONE.\n\nAll resource access is logged; at the discretion of the ISSM/ISSO scheduling tasks may be exempted.\n\nAccess authorization is restricted to scheduling tools, started tasks or other system applications required for running production jobs.\n\nOther users may have minimal access required for running production jobs with documentation properly approved and filed with the site security official (ISSM or equivalent).\n\nConsider the following recommendations when implementing security for Surrogate Users:\n\nKeep the use of Surrogate Users outside of those granted to the scheduling software to a minimum number of individuals.\n\nThe simplest configuration is to only use Surrogate resource for the appropriate Scheduling task/software for production scheduling purposes as documented.\n\nTemporary use of surrogate resource of the production batch to the scheduling tasks may be allowed for a period for testing by the appropriate specific production Support Team members. Authorization, eligibility, and test period are determined by site policy.\n\nAccess authorization is restricted to the minimum number of personnel required for running production jobs. However, Surrogate usage should not become the default for all jobs submitted by individual userids (i.e., system programmer must use their assigned individual userids for software installation, duties, whereas a Cross Authorized ACID would normally be utilized for scheduled batch production only and as such must normally be limited to the scheduling task such as CONTROLM) and not granted as a normal daily basis to individual users.\n\nCommand samples are provided to define/permit SURROGAT profiles:\n\nSETR CLASSACT(SURROGAT)\nSETR GENERIC(SURROGAT) GENCMD(SURROGAT)\nSETR RACL(SURROGAT)\n\nRDEF SURROGAT <batchid>.SUBMIT UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('SUBMIT JOBS FOR <batchid>, REFERENCE ZJES0060') \n\nPE <batchid>.SUBMIT CL(SURROGAT) ID(<authorized user such as CONTROLM>)","ccis":["CCI-000213","CCI-002233"]},{"vulnId":"V-223756","ruleId":"SV-223756r991589_rule","severity":"medium","ruleTitle":"IBM z/OS RJE workstations and NJE nodes must be controlled in accordance with security requirements.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Note that this guidance addresses RJE Workstations that are \"Dedicated\". If an RJE workstation is dedicated, the assumption is that the RJE to host connection is hard-wired between the RJE and host. In this case the RMT definition statement will contain the keyword LINE= which specifies that this RJE is only connected via that one LINE statement. \n\nRefer to the JES2PARM member of PARMLIB.\n\nIf all of the statements below are true, this is not a finding.\n\nIf any of the statements below are untrue, this is a finding.\n\nReview the JES2 parameters for RJE workstation definitions by searching for RMT( in the report.\n\nA userid of RMTnnnn is defined to RACF for each RJE workstation, where nnnn is the number on the RMT statement.\n\nNo userid segments (e.g., TSO, CICS, etc.) are defined.\n\nRestricted from accessing all data sets and resources with exception of the corresponding JESINPUT class profile for that remote.\n\nNOTE: Execute the JCL in CNTL(IRRUT100) using the RACF RMTnnnn userids as SYSIN input. This report lists all occurrences of these userids within the RACF database, including data set and resource access lists.\n\nA FACILITY-Class profile exists in the format RJE.RMTnnnn where nnn identifies the remote number.","fixText":"Note that this guidance addresses RJE Workstations that are \"Dedicated\". If an RJE workstation is dedicated, the assumption is that the RJE to host connection is hard-wired between the RJE and host. In this case the RMT definition statement will contain the keyword LINE= which specifies that this RJE is only connected via that one LINE statement. \n\n Review the JES2 parameters for RJE workstation definitions by searching for RMT( in the report.\n\n Configure the RJE workstation userids to be defined as follows:\n\n A userid of RMTnnnn is defined to RACF for each RJE workstation, where nnnn is the number on the RMT statement.\n\n No userid segments (e.g., TSO, CICS, etc.) are defined.\n\n Restricted from accessing all data sets and resources with exception of the corresponding JESINPUT-class profile for that remote.\n\nReview Chapter 17 of the RACF Security Admin Guide. The following is an example that show proper implementation:\n\nAG RMTGRP OWNER(ADMIN) SUPGROUP(ADMIN)\n\nAU RMT777 NAME('RMT RJE 777') DFLTGRP(RMTGRP) OWNER(RMTGRP) DATA('COMPLY WITH ZJES0011') NOPASS RESTRICTED\n\nPE RMT777 CL(JESINPUT) ID(RMT777)\n\n Ensure that a FACILITY-Class profile exists in the format RJE.RMTnnnn where nnn identifies the remote number.\n\nA command example is shown here:\n\nRDEF FACILITY RJE.RMT777 UACC(NONE) OWNER(ADMIN) DATA('COMPLY WITH ZJES0011 FOR RJE 777')","ccis":["CCI-000366"]},{"vulnId":"V-223757","ruleId":"SV-223757r958636_rule","severity":"medium","ruleTitle":"IBM z/OS must configure system wait times to protect resource availability based on site priorities.","description":"Automatic session termination addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions.\n\nSession termination terminates all processes associated with a user's logical session except those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated.\n\nConditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use.\n\nThis capability is typically reserved for specific operating system functionality where the system owner, data owner, or organization requires additional assurance.","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member. \n\nExamine the JWT, SWT, and TWT values.\n\nIf the JWT parameter is greater than \"15\" minutes, and the system is processing unclassified information, review the following items. \n\nIf any of these items is true, this is not a finding.\n\n-If a session is not terminated, but instead is locked out after \"15\" minutes of inactivity, a process must be in place that requires user identification and authentication before the session is unlocked. Session lock-out will be implemented through system controls or terminal screen protections.\n\n-A system's default time for terminal lock-out or session termination may be lengthened to \"30\" minutes at the discretion of the ISSM or ISSO. The ISSA and/or ISSO will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.\n\n-The ISSM and/or ISSO may set selected userids to have a time-out of up to \"60\" minutes to complete critical reports or transactions without timing out. Each exception must meet the following criteria:\n -The time-out exception cannot exceed \"60\" minutes.\n -A letter of justification fully documenting the user requirement(s) must be submitted and approved by the site ISSM or ISSO. In addition, this letter must identify an alternate means of access control for the terminal(s) involved (e.g., a room that is locked at all times, a room with a cipher lock to limit access, a password protected screen saver set to \"30\" minutes or less, etc.).\n -The requirement must be revalidated on an annual basis.\n\nIf the TWT and SWT values are equal or less than the JWT value, this is not a finding.","fixText":"Configure the SMFPRMxx JWT to \"15\" minutes for classified systems.\n\nThe JWT parameter can be greater than \"15\" minutes if the system is processing unclassified information and the following items are reviewed:\n-If a session is not terminated, but instead is locked out after \"15\" minutes of inactivity, a process must be in place that requires user identification and authentication before the session is unlocked. Session lock-out will be implemented through system controls or terminal screen protections.\n\n-A system's default time for terminal lock-out or session termination may be lengthened to \"30\" minutes at the discretion of the ISSM or ISSO. The ISSM and/or ISSO will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.\n\n-The ISSM and/or ISSO may set selected userids to have a time-out of up to \"60\" minutes to complete critical reports or transactions without timing out. Each exception must meet the following criteria:\n -The time-out exception cannot exceed 60 minutes.\n -A letter of justification fully documenting the user requirement(s) must be submitted and approved by the site ISSM or ISSO. In addition, this letter must identify an alternate means of access control for the terminal(s) involved (e.g., a room that is locked at all times, a room with a cipher lock to limit access, a password protected screen saver set to 30 minutes or less, etc.).\n -The requirement must be revalidated on an annual basis.\n\nConfigure any TWT and or SWT to be equal or less than the JWT.","ccis":["CCI-002361"]},{"vulnId":"V-223758","ruleId":"SV-223758r958406_rule","severity":"medium","ruleTitle":"The IBM z/OS BPX.SMF resource must be properly configured.","description":"Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).","checkContent":"Review the FACILITY resource class for BPX.SMF. \n\nIf the RACF rules are as follows this is not a finding.\n\nBPX.SMF.119.94 - READ allowed for users running the ssh, sftp, or scp client commands.\nBPX.SMF.119.96 - READ allowed for users running the scp or sftp-server server commands.\nBPX.SMF.119.97 - READ allowed for users running the scp or sftp client commands.\n\nThe following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:\n\nBPX.SMF - READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable.","fixText":"Configure Facility resource class for BPX.SMF as follows:\nBPX.SMF.119.94 - READ allowed for users running the ssh, sftp, or scp client commands.\nBPX.SMF.119.96 - READ allowed for users running the scp or sftp-server server commands.\nBPX.SMF.119.97 - READ allowed for users running the scp or sftp client commands.\n\nThe following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:\n\nBPX.SMF - READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable.","ccis":["CCI-000067"]},{"vulnId":"V-223759","ruleId":"SV-223759r958846_rule","severity":"medium","ruleTitle":"IBM z/OS SMF recording options for the TN3270 Telnet Server must be properly specified.","description":"The TN3270 Telnet Server can provide audit data in the form of SMF records. The SMF data produced provides information about individual sessions. This data includes the VTAM application, the remote and local IP addresses, and the remote and local IP port numbers. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.\n\nSatisfies: SRG-OS-000392-GPOS-00172, SRG-OS-000032-GPOS-00013","checkContent":"Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.\n\nIf the following configuration statement settings are in effect in the TCP/IP Profile configuration data set, this is not a finding.\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration data set, the data set specified on this statement must be checked for the following items as well.\n\nThe TELNETPARMS SMFINIT statement is coded with the TYPE119 operand within each TELNETPARMS statement block.\n\nThe TELNETPARMS SMFTERM statement is coded with the TYPE119 operand within each TELNETPARMS statement block.\n\nNote: The SMFINIT and SMFTERM statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks. If duplicate statements appear in the TELNETGLOBALS, TELNETPARMS, Telnet uses the last valid statement that was specified.","fixText":"Configure the TELNETPARMS SMFINIT and SMFTERM statements in the PROFILE.TCPIP file to conform to the requirements specified below.\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nThe TELNETPARMS SMFINIT statement is coded with the TYPE119 operand within each TELNETPARMS statement block.\n\nThe TELNETPARMS SMFTERM statement is coded with the TYPE119 operand within each TELNETPARMS statement block.\n\nNote: The SMFINIT and SMFTERM statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks. If duplicate statements appear in the TELNETGLOBALS, TELNETPARMS, Telnet uses the last valid statement that was specified.","ccis":["CCI-000067","CCI-002884"]},{"vulnId":"V-223760","ruleId":"SV-223760r958362_rule","severity":"high","ruleTitle":"IBM RACF must be installed and active on the system.","description":"Enterprise environments make account management for operating systems challenging and complex. A manual process for account management functions adds the risk of a potential oversight or other errors. IBM z/OS requires an external security manager to assure proper account management.","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper IEFSSnxx member.\n\nIf RACF is defined in the SubSystem member, this is not a finding.","fixText":"Refer to the IBM Security Server RACF System Programmer Guide and the IBM Security Server RACF Security Administrator guide to properly implement RACF on the system.","ccis":["CCI-000015"]},{"vulnId":"V-223761","ruleId":"SV-223761r998357_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to disable emergency accounts after the crisis is resolved or 72 hours.","description":"Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. \n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's SAs when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.","checkContent":"Ask the SA for the documented process to disable emergency accounts. \n\nIf there is no documented process, this is a finding.\n\nExamine the process, if it does not include procedures to disable emergency accounts after the crisis is resolved or 72 hours, this is a finding.","fixText":"Develop a process to disable emergency accounts after the crisis is resolved or 72 hours.","ccis":["CCI-001682","CCI-003628"]},{"vulnId":"V-223762","ruleId":"SV-223762r998358_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are created.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create a new account. Notification of account creation is one method for mitigating this risk. A comprehensive account management process will ensure an audit trail which documents the creation of operating system user accounts and notifies SAs and information system security officers (ISSOs) that it exists. Such a process greatly reduces the risk that accounts will be surreptitiously created and provides logging that can be used for forensic purposes.\n\nTo address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.","checkContent":"Ask the system Administrator for the documented process to notify appropriate personnel when accounts are created.\n\nIf there is no documented process, this is a finding.","fixText":"Develop a documented develop a process to notify appropriate personnel when accounts are created.","ccis":["CCI-000015"]},{"vulnId":"V-223763","ruleId":"SV-223763r998360_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are modified.","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.","checkContent":"Ask the SA for the documented process to notify appropriate personnel when accounts are modified.\n\nIf there is no documented process, this is a finding.","fixText":"Develop a documented develop a process to notify appropriate personnel when accounts are modified.","ccis":["CCI-000015"]},{"vulnId":"V-223764","ruleId":"SV-223764r998362_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are deleted.","description":"Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.","checkContent":"Ask the SA for the documented process to notify appropriate personnel when accounts are deleted.\n\nIf there is no documented process, this is a finding.","fixText":"Develop a documented develop a process to notify appropriate personnel when accounts are deleted.","ccis":["CCI-000015"]},{"vulnId":"V-223765","ruleId":"SV-223765r998364_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to notify appropriate personnel when accounts are removed.","description":"When operating system accounts are removed, user accessibility is affected. Accounts are utilized for identifying individual operating system users or for identifying the operating system processes themselves. Sending notification of account removal events to the SAs and information system security officers (ISSOs) is one method for mitigating this risk. Such a capability greatly reduces the risk that operating system accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes.","checkContent":"Ask the SA for the documented process to notify appropriate personnel when accounts are removed.\n\nIf there is no documented process, this is a finding.","fixText":"Develop a documented develop a process to notify appropriate personnel when accounts are removed.","ccis":["CCI-000015"]},{"vulnId":"V-223766","ruleId":"SV-223766r998367_rule","severity":"medium","ruleTitle":"The IBM z/OS system administrator (SA) must develop a process to notify information system security officers (ISSOs) of account enabling actions.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to enable an existing disabled account. Sending notification of account enabling actions to the SAs and ISSOs is one method for mitigating this risk. Such a capability greatly reduces the risk that operating system accessibility will be negatively affected for extended periods of time and also provides logging that can be used for forensic purposes.\n\nIn order to detect and respond to events that affect user accessibility and application processing, operating systems must audit account enabling actions and, as required, notify the appropriate individuals so they can investigate the event.\n\nTo address access requirements, many operating systems can be integrated with enterprise-level authentication/access/auditing mechanisms that meet or exceed access control policy requirements.","checkContent":"Ask the SA for the documented processes to notify the ISSOs of account enabling actions.\n\nIf there is no documented process, this is a finding.","fixText":"Develop a documented process to notify the ISSOs of account enabling actions.","ccis":["CCI-000015"]},{"vulnId":"V-223767","ruleId":"SV-223767r998368_rule","severity":"medium","ruleTitle":"IBM z/OS required SMF data record types must be collected.","description":"Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an account. Auditing account creation actions provides logging that can be used for forensic purposes.\n\nTo address access requirements, many operating systems may be integrated with enterprise level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. \n\nSatisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00020, SRG-OS-000042-GPOS-00021, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000327-GPOS-00127, SRG-OS-000365-GPOS-00152, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000467-GPOS-00211, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member.\n\nIf all of the required SMF record types identified below are collected, this is not a finding.\n\nIBM SMF Records to be collect at a minimum:\n\n0 (00) - IPL\n6 (06) - External Writer/ JES Output Writer/ Print Services Facility (PSF)\n7 (07) - [SMF] Data Lost\n14 (0E) - INPUT or RDBACK Data Set Activity\n15 (0F) - OUTPUT, UPDAT, INOUT, or OUTIN Data Set Activity\n17 (11) - Scratch Data Set Status\n18 (12) - Rename Non-VSAM Data Set Status\n24 (18) - JES2 Spool Offload\n25 (19) - JES3 Device Allocation\n26 (1A) - JES Job Purge\n30 (1E) - Common Address Space Work\n32 (20) - TSO/E User Work Accounting\n41 (29) - DIV Objects and VLF Statistics \n42 (2A) - DFSMS statistics and configuration \n43 (2B) - JES Start\n45 (2D) - JES Withdrawal/Stop\n47 (2F) - JES SIGNON/Start Line (BSC)/LOGON\n48 (30) - JES SIGNOFF/Stop Line (BSC)/LOGOFF\n49 (31) - JES Integrity\n52 (34) - JES2 LOGON/Start Line (SNA)\n53 (35) - JES2 LOGOFF/Stop Line (SNA)\n54 (36) - JES2 Integrity (SNA)\n55 (37) - JES2 Network SIGNON\n56 (38) - JES2 Network Integrity\n57 (39) - JES2 Network SYSOUT Transmission\n58 (3A) - JES2 Network SIGNOFF\n60 (3C) - VSAM Volume Data Set Updated\n61 (3D) - Integrated Catalog Facility Define Activity\n62 (3E) - VSAM Component or Cluster Opened\n64 (40) - VSAM Component or Cluster Status\n65 (41) - Integrated Catalog Facility Delete Activity\n66 (42) - Integrated Catalog Facility Alter Activity\n80 (50) - RACF/TOP SECRET Processing\n81 (51) - RACF Initialization\n82 (52) - ICSF Statistics\n83 (53) - RACF Audit Record For Data Sets\n90 (5A) - System Status\n92 (5C) except subtypes 10, 11 - OpenMVS File System Activity\n102 (66) - DATABASE 2 Performance \n103 (67) - IBM HTTP Server\n110 (6E) - CICS/ESA Statistics\n118 (76) - TCP/IP Statistics\n119 (77) - TCP/IP Statistics \n199 (C7) - TSOMON\n230 (E6) - ACF2 or as specified in ACFFDR (vendor-supplied default is 230)\n231 (E7) - TSS logs security events under this record type","fixText":"Ensure that SMF recording options are consistent with those outlined below.\n\nIBM SMF Records to be collect at a minimum:\n\n0 (00) - IPL\n6 (06) - External Writer/ JES Output Writer/ Print Services Facility (PSF)\n7 (07) - [SMF] Data Lost\n14 (0E) - INPUT or RDBACK Data Set Activity\n15 (0F) - OUTPUT, UPDAT, INOUT, or OUTIN Data Set Activity\n17 (11) - Scratch Data Set Status\n18 (12) - Rename Non-VSAM Data Set Status\n24 (18) - JES2 Spool Offload\n25 (19) - JES3 Device Allocation\n26 (1A) - JES Job Purge\n30 (1E) - Common Address Space Work\n32 (20) - TSO/E User Work Accounting\n41 (29) - DIV Objects and VLF Statistics \n42 (2A) - DFSMS statistics and configuration \n43 (2B) - JES Start\n45 (2D) - JES Withdrawal/Stop\n47 (2F) - JES SIGNON/Start Line (BSC)/LOGON\n48 (30) - JES SIGNOFF/Stop Line (BSC)/LOGOFF\n49 (31) - JES Integrity\n52 (34) - JES2 LOGON/Start Line (SNA)\n53 (35) - JES2 LOGOFF/Stop Line (SNA)\n54 (36) - JES2 Integrity (SNA)\n55 (37) - JES2 Network SIGNON\n56 (38) - JES2 Network Integrity\n57 (39) - JES2 Network SYSOUT Transmission\n58 (3A) - JES2 Network SIGNOFF\n60 (3C) - VSAM Volume Data Set Updated\n61 (3D) - Integrated Catalog Facility Define Activity\n62 (3E) - VSAM Component or Cluster Opened\n64 (40) - VSAM Component or Cluster Status\n65 (41) - Integrated Catalog Facility Delete Activity\n66 (42) - Integrated Catalog Facility Alter Activity\n80 (50) - RACF/TOP SECRET Processing\n81 (51) - RACF Initialization\n82 (52) - ICSF Statistics\n83 (53) - RACF Audit Record For Data Sets\n90 (5A) - System Status\n92 (5C) except subtypes 10, 11 - OpenMVS File System Activity\n102 (66) - DATABASE 2 Performance \n103 (67) - IBM HTTP Server\n110 (6E) - CICS/ESA Statistics\n118 (76) - TCP/IP Statistics\n119 (77) - TCP/IP Statistics \n199 (C7) - TSOMON\n230 (E6) - ACF2 or as specified in ACFFDR (vendor-supplied default is 230)\n231 (E7) - TSS logs security events under this record type","ccis":["CCI-000018","CCI-000130","CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-000135","CCI-000172","CCI-001403","CCI-001404","CCI-001405","CCI-003938","CCI-002130","CCI-002234","CCI-002884"]},{"vulnId":"V-223768","ruleId":"SV-223768r958390_rule","severity":"medium","ruleTitle":"IBM z/OS must employ a session manager to manage display of the Standard Mandatory DoD Notice and Consent Banner.","description":"Display of a standardized and approved use notification before granting access to the operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. All methods of gaining access to the system must comply with this requirement to assure that regulations are upheld.","checkContent":"Verify that any session manger in use displays the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.\n\nIf the session manager does not display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system, this is a finding.","fixText":"Configure any session manger in use to display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.","ccis":["CCI-000048"]},{"vulnId":"V-223769","ruleId":"SV-223769r958414_rule","severity":"medium","ruleTitle":"IBM z/OS must specify SMF data options to assure appropriate activation.","description":"SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised.\n\nSatisfies: SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000254-GPOS-00095, SRG-OS-000269-GPOS-00103","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member. \n\nIf the following SMF collection options are specified as stated below, this is not a finding. \n\nThe settings for several parameters are critical to the collection process:\n\nACTIVE - Activates the collection of SMF data.\n\nMAXDORM - Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set. Value is site defined.\n\nSID - Specifies the system ID to be recorded in all SMF records.\n\nSYS(DETAIL) - Controls the level of detail recorded.\n\nSYS(INTERVAL) - Ensures the periodic recording of data for long running jobs.\n\nSYS - Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed.","fixText":"Ensure that collection options for SMF Data are consistent with options specified below.\n\nReview all SMF recording specifications found in SMFPRMxx members. Ensure that SMF recording options used are consistent with those outlined below.\n\nThe settings for several parameters are critical to the collection process:\n\nACTIVE - Activates the collection of SMF data.\n\nMAXDORM(mmss) - Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set. Use the MAXDORM parameter to minimize the amount of data lost because of system failure. This value is site determined and should be carefully configured.\n\nSID - Specifies the system ID to be recorded in all SMF records.\n\nSYS(DETAIL) - Controls the level of detail recorded.\n\nSYS(INTERVAL) - Ensures the periodic recording of data for long running jobs.\n\nSYS - Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types not listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed.","ccis":["CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-000135","CCI-001464","CCI-001665"]},{"vulnId":"V-223770","ruleId":"SV-223770r958752_rule","severity":"medium","ruleTitle":"IBM z/OS SMF collection files (system MANx datasets or LOGSTREAM DASD) must have storage capacity to store at least one weeks worth of audit data.","description":"In order to ensure operating systems have a sufficient storage capacity in which to write the audit logs, operating systems need to be able to allocate audit record storage capacity.\n\nThe task of allocating audit record storage capacity is usually performed during initial installation of the operating system.","checkContent":"Review the SMF dump procedure in there system.\n\nIf the output datasets in the procedure have storage capacity to store at least one week's worth of audit data, this is not a finding.","fixText":"Make sure output file and dump procedures allow storage capacity to store one week's worth of audit data.","ccis":["CCI-001849"]},{"vulnId":"V-223771","ruleId":"SV-223771r958754_rule","severity":"medium","ruleTitle":"IBM z/OS system administrators must develop an automated process to collect and retain SMF data.","description":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.","checkContent":"Ask the system administrator if there is an automated process is in place to collect and retain all SMF data produced on the system.\n\nIf, based on the information provided, it can be determined that an automated process is in place to collect and retain all SMF data produced on the system, this is not a finding.\n\nIf it cannot be determined this process exists and is being adhered to, this is a finding.","fixText":"The ISSO will ensure that an automated process is in place to collect SMF data.\n\nReview SMF data collection and retention processes. Develop processes are automatically started to dump SMF collection files immediately upon their becoming full.\n\nTo ensure that all SMF data is collected in a timely manner, and to reduce the risk of data loss, the site will ensure that automated mechanisms are in place to collect and retain all SMF data produced on the system. Dump the SMF files (MANx) in systems based on the following guidelines:\n\n-Dump each SMF file as it fills up during the normal course of daily processing\n-Dump all remaining SMF data at the end of each processing day or \n-Establish a process using Audit logging","ccis":["CCI-001851"]},{"vulnId":"V-223772","ruleId":"SV-223772r971542_rule","severity":"medium","ruleTitle":"IBM z/OS BUFUSEWARN in the SMFPRMxx must be properly set.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without this notification, the security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.\n\nAudit processing failures include software/hardware errors, failures in the audit capturing mechanisms, and audit storage capacity being reached or exceeded.\n\nThis requirement applies to each audit data storage repository (i.e., distinct information system component where audit records are stored), the centralized audit storage capacity of organizations (i.e., all audit data storage repositories combined), or both.\n\nSatisfies: SRG-OS-000343-GPOS-00134, SRG-OS-000344-GPOS-00135, SRG-OS-000046-GPOS-00022","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member in SYS1.PARMLIB.\n\nIf BUFUSEWARN is set for \"75\" (75%) or less, this is not a finding.","fixText":"Configure the BUFUSEWARN statement in SMFPRMxx to \"75\" (75%) or less.","ccis":["CCI-000139","CCI-001855","CCI-001858"]},{"vulnId":"V-223773","ruleId":"SV-223773r1038966_rule","severity":"medium","ruleTitle":"IBM z/OS NOBUFFS in SMFPRMxx must be properly set (default is MSG).","description":"It is critical that when the operating system is at risk of failing to process audit logs as required, it takes action to mitigate the failure. Audit processing failures include: software/hardware errors; failures in the audit capturing mechanisms; and audit storage capacity being reached or exceeded. Responses to audit failure depend upon the nature of the failure mode.\n\nWhen availability is an overriding concern, other approved actions in response to an audit failure are as follows: \n\nIf the failure was caused by the lack of audit record storage capacity, the operating system must continue generating audit records if possible (automatically restarting the audit service if necessary), overwriting the oldest audit records in a first-in-first-out manner.\n\nIf audit records are sent to a centralized collection server and communication with this server is lost or the server fails, the operating system must queue audit records locally until communication is restored or until the audit records are retrieved manually. Upon restoration of the connection to the centralized collection server, action should be taken to synchronize the local audit data with the collection server.","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member in SYS1.PARMLIB.\n\nIf NOBUFFS is set to \"HALT\", this is not a finding.\n\nNote: If availability is an overriding concern NOBUFFS can be set to MSG.","fixText":"Configure NOBUFFS to \"HALT\" unless availability is an overriding concern then NOBUFFS can be set to MSG.","ccis":["CCI-000140"]},{"vulnId":"V-223774","ruleId":"SV-223774r1169910_rule","severity":"medium","ruleTitle":"The IBM z/OS system must use a time protocol that syncs with an authoritative external time source.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\n\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).","checkContent":"Verify the operating system, for networked systems, compares internal information system clocks at least every 24 hours with a server synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DOD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). \n\nIf it does not, this is a finding.","fixText":"Coordinate with system staff to determine the best time protocols available for the z/OS systems at the site. SNT is one protocol available.\nObtain a copy of this sample procedure from SEZAINST and store it in one of the PROCLIB concatenation data sets.\n\nPerform the following to start SNTPD as a procedure:\nInvoke the procedure using the system operator start command. The following sample, SEZAINST(SNTPD), shows how to start SNTPD as a procedure:\n//*\n//* Sample procedure for the Simple Network Time Protocol (SNTP)\n//*\n//* z/OS Communications Server Version 1 Release 13\n//* SMP/E Distribution Name: SEZAINST(EZASNPRO)\n//*\n//* Copyright: Licensed Materials - Property of IBM\n//* 5650-ZOS\n//* Copyright IBM Corp. 2002, 2015\n//*\n//* Status: CSV2R2\n//*\n//SNTPD EXEC PGM=SNTPD,REGION=4096K,TIME=NOLIMIT,\n//PARM='/ -d'\n//SYSPRINT DD SYSOUT=*,DCB=(RECFM=F,LRECL=132,BLKSIZE=132)\n//SYSIN DD DUMMY\n//SYSERR DD SYSOUT=*\n//SYSOUT DD SYSOUT=*,DCB=(RECFM=F,LRECL=132,BLKSIZE=132)\n//CEEDUMP DD SYSOUT=*\n//SYSABEND DD SYSOUT=*","ccis":["CCI-004923"]},{"vulnId":"V-223775","ruleId":"SV-223775r1174002_rule","severity":"medium","ruleTitle":"IBM z/OS Time Protocol must be properly configured.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time, a particular event occurred on a system is critical when conducting forensic analysis and investigating system events. Sources outside the configured acceptable allowance (drift) may be inaccurate.\n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network.\n\nOrganizations should consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints).","checkContent":"Any Time Protocol must be configured to restrict access and/or control to appropriate personnel. \n\nConfigure SNTP as shown below:\n\nFrom the ISPF Command Shell, enter:\ncd /usr/sbin\nls -al\n\nIf the following file permission and user audit bits are true, this is not a finding.\n\n/usr/sbin/sntpd 1740 faf\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"Whichever Time Protocol is used, consult the system programmer for configuration information. If using SNTP with the assistance of a systems programmer with UID(0) and/or SUPERUSER access, configure the Unix permission bits and user audit bits on the SNTPD to conform to the specifications below:\n\n/usr/sbin/sntpd 1740 faf","ccis":["CCI-004923"]},{"vulnId":"V-223776","ruleId":"SV-223776r998371_rule","severity":"medium","ruleTitle":"IBM z/OS PARMLIB CLOCKxx must have the Accuracy PARM properly coded.","description":"Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when conducting forensic analysis and investigating system events.\n\nSynchronizing internal information system clocks provides uniformity of time stamps for information systems with multiple system clocks and systems connected over a network. Organizations should consider setting time periods for different types of systems (e.g., financial, legal, or mission-critical systems).\n\nOrganizations should also consider endpoints that may not have regular access to the authoritative time server (e.g., mobile, teleworking, and tactical endpoints). This requirement is related to the comparison done every 24 hours in SRG-OS-000355 because a comparison must be done in order to determine the time difference.","checkContent":"Refer to the CLOCKxx member of PARMLIB.\n\nIf the ACCURACY parm is not coded, this is a finding.\n\nIf the ACCURACY parm is coded to \"1000\", this is not a finding.","fixText":"Define the CLOCKxx statement to include the ACCURACY parm set to \"1000\".","ccis":["CCI-004922","CCI-004926"]},{"vulnId":"V-223777","ruleId":"SV-223777r1050763_rule","severity":"high","ruleTitle":"IBM RACF must define UACC of NONE on all profiles.","description":"The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs.","checkContent":"Review all Dataset and resource profiles in the RACF database.\n\nIf any are not defined with UACC NONE, this is a finding. \n\nThere is an exception when evaluating the UACC for DIGTCERT and NODES resource classes.\n\nThe universal access (UACC) for DIGTCERT profiles:\nFor profiles in classes other than DIGTCERT, the valid values are NONE, READ, EXECUTE, UPDATE, CONTROL, and ALTER. For DIGTCERT profiles, the valid values are TRUST, NOTRUST, and HIGHTRST.  \nIf DIGTCERT Profiles are defined with other than UACC NONE, this is not a finding.\n\nThe universal access (UACC) for NODES:\nA UACC of NONE fails the inbound job.\nIf NODES profiles are defined with other than UACC NONE, this is not a finding.","fixText":"Define each dataset and resource profile with UACC(NONE), excluding the exceptions of NODES and DIGTCERT profiles.","ccis":["CCI-001774"]},{"vulnId":"V-223778","ruleId":"SV-223778r991589_rule","severity":"medium","ruleTitle":"IBM z/OS PASSWORD data set and OS passwords must not be used.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Ask the system administrator to determine if the system PASSWORD data set and OS passwords are being used.\n\nIf, based on the information provided, it can be determined that the system PASSWORD data set and OS passwords are not used, this is not a finding.\n\nIf it is evident that OS passwords are utilized, this is a finding.","fixText":"System programmers will ensure that the old OS Password Protection is not used and any data protected by the old OS Password technology is removed and protection is replaced by the ACP.\n\nReview the contents of the PASSWORD data set. Ensure that any protections it provides are provided by the ACP and delete the PASSWORD data set.\n\nAccess to data sets on z/OS systems can be protected using the OS password capability of MVS. This capability has been available in MVS for many years, and its use is commonly found in data centers. Since the advent of ACPs, the use of OS passwords for file protection has diminished, and is commonly considered archaic and of little use. The use of z/OS passwords is not supported by all the ACPs.","ccis":["CCI-000366"]},{"vulnId":"V-223780","ruleId":"SV-223780r991593_rule","severity":"medium","ruleTitle":"The IBM z/OS Policy Agent must employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.","description":"Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems. It also permits outbound connections that may facilitate exfiltration of DoD data.","checkContent":"Examine the policy agent policy statements. \n\nIf it can be determined that the policy agent employs a deny-all, allow-by exception firewall policy for allowing connections to other systems this is not a finding.","fixText":"Develop a policy application and policy agent to employ a deny-all, allow-by-exception firewall policy for allowing connections to other systems.","ccis":["CCI-000366","CCI-002080"]},{"vulnId":"V-223781","ruleId":"SV-223781r958804_rule","severity":"high","ruleTitle":"Unsupported system software must not be installed and/ or active on the system.","description":"Control of program execution is a mechanism used to prevent execution of unauthorized programs. Some operating systems may provide a capability that runs counter to the mission or provides users with functionality that exceeds mission requirements. This includes functions and services installed at the operating system level.\n\nSome of the programs, installed by default, may be harmful or may not be necessary to support essential organizational operations (e.g., key missions, functions). Removal of executable programs is not always possible; therefore, establishing a method of preventing program execution is critical to maintaining a secure system baseline.\n\nMethods for complying with this requirement include restricting execution of programs in certain environments, while preventing execution in other environments; or limiting execution of certain program functionality based on organization-defined criteria (e.g., privileges, subnets, sandboxed environments, or roles).","checkContent":"This check applies to all products that meet the following criteria:\n\n- Uses authorized and restricted z/OS interfaces by utilizing Authorized Program Facility (APF) authorized modules or libraries.\n- Requires access to system datasets or sensitive information or requires special or privileged authority to run.\n\nFor the products in the above category, refer to the Vendor's support lifecycle information for current versions and releases. \n\nIf the software products currently running on the reviewed system are at a version greater than or equal to the products listed in the vendor's Support Lifecycle information, this is not a finding.","fixText":"For all products that meet the following criteria:\n\n- Uses authorized and restricted z/OS interfaces by utilizing Authorized Program Facility (APF) authorized modules or libraries.\n- Requires access to system datasets or sensitive information or requires special or privileged authority to run.\n\nThe ISSO will ensure that unsupported system software for the products in the above category is removed or upgraded prior to a vendor dropping support.\n\nAuthorized software that is NO longer supported is a CAT I vulnerability. The customer and site will be given six months to mitigate the risk, develop a supported solution, or obtain a formal letter approving such risk/software.","ccis":["CCI-001764"]},{"vulnId":"V-223782","ruleId":"SV-223782r958804_rule","severity":"medium","ruleTitle":"IBM z/OS must not allow nonexistent or inaccessible LINKLIST libraries.","description":"Control of program execution is a mechanism used to prevent execution of unauthorized programs. Some operating systems may provide a capability that runs counter to the mission or provides users with functionality that exceeds mission requirements. This includes functions and services installed at the operating system level.\n\nSome of the programs, installed by default, may be harmful or may not be necessary to support essential organizational operations (e.g., key missions, functions). Removal of executable programs is not always possible; therefore, establishing a method of preventing program execution is critical to maintaining a secure system baseline.\n\nMethods for complying with this requirement include restricting execution of programs in certain environments, while preventing execution in other environments; or limiting execution of certain program functionality based on organization-defined criteria (e.g., privileges, subnets, sandboxed environments, or roles).","checkContent":"From and ISPF Command line enter:\nTSO ISRDDN LINKLIST\n\nReview the list, if there are any DUMMY entries i.e., inaccessible LINKLIST libraries, this is a finding.","fixText":"Review all entries contained in the LINKLIST for the actual existence of each library. Develop a plan of action to correct deficiencies.\n\nThe Linklist is a default set of libraries that MVS searches for a specified program. This facility is used so that a user does not have to know the library names in which utility types of programs are stored. Control over membership in the Linklist is specified within the operating system. The data set SYS1.PARMLIB(LNKLSTxx) is used to specify the library names. (The xx is the suffix designated by the LNK parameter in the IEASYSxx member of SYS1.PARMLIB, or overridden by the computer operator at IPL.)\n\nUse the following recommendations and techniques to control the exposures created by the LINKLIST facility:\n\n-Avoid inclusion of sensitive libraries in the LNKLSTxx member unless absolutely required.\n\n-The LNKLSTxx and PROGxx (LNKLST entries) members will contain only required libraries. On a semiannual basis, Software Support should review the volume serial numbers, and should verify them in accordance with the system catalog. Software Support will remove all nonexistent libraries. The ISSO should modify and/or delete the rules associated with these libraries.","ccis":["CCI-001764"]},{"vulnId":"V-223783","ruleId":"SV-223783r958804_rule","severity":"medium","ruleTitle":"IBM z/OS must not allow nonexistent or inaccessible Link Pack Area (LPA) libraries.","description":"Control of program execution is a mechanism used to prevent execution of unauthorized programs. Some operating systems may provide a capability that runs counter to the mission or provides users with functionality that exceeds mission requirements. This includes functions and services installed at the operating system level.\n\nSome of the programs, installed by default, may be harmful or may not be necessary to support essential organizational operations (e.g., key missions, functions). Removal of executable programs is not always possible; therefore, establishing a method of preventing program execution is critical to maintaining a secure system baseline.\n\nMethods for complying with this requirement include restricting execution of programs in certain environments, while preventing execution in other environments; or limiting execution of certain program functionality based on organization-defined criteria (e.g., privileges, subnets, sandboxed environments, or roles).","checkContent":"From and ISPF Command line enter:\nTSO ISRDDN LPA\n\nReview the list, if there are any DUMMY entries i.e., inaccessible LPA libraries, this is a finding.","fixText":"Review all entries contained in the LPA members for the actual existence of each library. Develop a plan of action to correct deficiencies. \n\nThe system Link Pack Area (LPA) is the component of MVS that maintains core operating system functions resident in main storage. A security concern exists when libraries from which LPA modules are obtained require APF authorization.\n\nControl over residence in the LPA is specified within the operating system in the following members of the data set SYS1.PARMLIB:\n\n-LPALSTxx specifies the names of libraries to be concatenated to SYS1.LPALIB when the LPA is generated at IPL in an MVS/XA or MVS/ESA system. (The xx is the suffix designated by the LPA parameter in the IEASYSxx member of SYS1.PARMLIB or overridden by the computer operator at system initial program load [IPL].)\n\n-IEAFIXxx specifies the names of modules from SYS1.SVCLIB, the LPALSTxx concatenation, and the LNKLSTxx concatenation that are to be temporarily fixed in central storage in the Fixed LPA (FLPA) for the duration of an IPL. (The xx is the suffix designated by the FIX parameter in the IEASYSxx member of SYS1.PARMLIB or overridden by the computer operator at IPL.)\n\n-IEALPAxx specifies the names of modules that will be loaded from the following:\n\n? SYS1.SVCLIB\n? The LPALSTxx concatenation\n? The LNKLSTxx concatenation as a temporary extension to the existing Pageable\n\nLPA (PLPA) in the Modified LPA (MLPA) for the duration of an IPL. (The xx is the suffix designated by the MLPA parameter in the IEASYSxx member of SYS1.PARMLIB or overridden by the computer operator at IPL.)\n\nUse the following recommendations and techniques to control the exposures created by the LPA facility:\n\n-The LPALSTxx, IEAFIXxx, and IEALPAxx members will contain only required libraries. On a semiannual basis, Software Support should review the volume serial numbers, and should verify them in accordance with the system catalog. Software Support will remove all nonexistent libraries. The ISSO should modify and/or delete the rules associated with these libraries.","ccis":["CCI-001764"]},{"vulnId":"V-223784","ruleId":"SV-223784r958478_rule","severity":"medium","ruleTitle":"IBM z/OS must not have inaccessible APF libraries defined.","description":"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\n\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper APF and/or PROG member.\n\nExamine each entry and verify that it exists on the specified volume. \n\nIf inaccessible APF libraries exist, this is a finding.\n\nISRDDN APF","fixText":"Review the entire list of APF authorized libraries and remove those which are no longer valid designations.","ccis":["CCI-000381"]},{"vulnId":"V-223785","ruleId":"SV-223785r958478_rule","severity":"medium","ruleTitle":"IBM zOS inapplicable PPT entries must be invalidated.","description":"It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).\n\nExamples of non-essential capabilities include, but are not limited to, games, software packages, tools, and demonstration software, not related to requirements or providing a wide array of functionality not required for every mission, but which cannot be disabled.\n\nInvalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities.","checkContent":"Review program entries in the IBM Program Properties Table (PPT). You may use a third-party product to examine these entries; however, to determine program entries, issue the following command from an ISPF command line:\nTSO ISRDDN LOAD IEFSDPPT\n\nInterpret the display as follows:\nExamine contents at offset 8 \nHex 'x2' - Bypass Password Protection \nHex 'x3' - Bypass Password Protection\nHex 'x4' - No Dataset Integrity\nHex 'x5' - No Dataset Integrity\nHex 'x6' - Both\nHex 'x7' - Both \n\nDetermine Privilege Key at offset 9. A value of hex '70' or less indicates an elevated privilege.\n\nFor each module identified in the \"eyecatcher\" that has BYPASS Password Protection, No Dataset Integrity, an elevated Privilege Key or any combination thereof, determine if there is a valid loaded module. Again, you may use a third-party product; otherwise, execute the following steps from an ISPF command line:\nTSO ISRDDN LOAD <privileged module>\n\nIf the return message is \"Load Failed\", make sure there is an entry in PARMLIB member SCHEDxx that revokes the excessive privilege.\n\nIf this is not true, this is a finding.","fixText":"Review the PPT and define all entries associated with nonexistent or inapplicable modules as invalidated. Nullify the invalid IEFSDPPT entry by ensuring that there is a corresponding SCHED entry, which confers no special attributes. \n\nUse the following recommendations and techniques to provide protection for the PPT:\n\nReview the IEFSDPPT module and all programs that IBM has, by default, placed in the PPT to validate their applicability to the execution system. Refer to the IBM z/OS MVS Initialization and Tuning Reference documentation for the version and release of z/OS installed at the individual site for the actual contents of the default IEFSDPPT. \n\nModules for products not in use on the system will have their special privileges explicitly revoked. Do this by placing a PPT entry for each module in the SYS1.PARMLIB(SCHEDxx) member, specifying no special privileges. The PPT entry for each overridden program will be in the following format, accepting the default (unprivileged) values for the subparameters:\n\nPPT PGMNAME(<program name>)\n\nAssemble documentation regarding these PPT entries, and the ISSO will keep it on file. Include the following in the documentation:\n\n- The product and release for which the PPT entry was made\n- The last date this entry was reviewed to authenticate status\n- The reason the module's privileges are being revoked","ccis":["CCI-000381"]},{"vulnId":"V-223786","ruleId":"SV-223786r958478_rule","severity":"medium","ruleTitle":"IBM z/OS LNKAUTH=APFTAB must be specified in the IEASYSxx member(s) in the currently active parmlib data set(s).","description":"Failure to specify LINKAUTH=APFTAB allows libraries other than those designated as APF to contain authorized modules which could bypass security and violate the integrity of the operating system environment. This expanded authorization list inhibits the ability to control inclusion of these modules.","checkContent":"Refer to IEASYS00 member in SYS1.PARMLIB Concatenation.\n\nIf LNKAUTH=APFTAB is not specified, this is a finding.","fixText":"Configure LNKAUTH=APFTAB in the IEASYS00 member of PARMLIB.","ccis":["CCI-000381"]},{"vulnId":"V-223787","ruleId":"SV-223787r958478_rule","severity":"low","ruleTitle":"IBM z/OS must not have duplicated sensitive utilities and/or programs existing in APF libraries.","description":"Removal of unneeded or non-secure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources.","checkContent":"From an ISPF Command line enter:\nTSO ISRDDN APF\n\nAn APF List results\n\nOn the command line enter:\nDUPlicates (make sure there is appropriate access; if there is not you may receive insufficient access errors)\n\nIf any of the list of Sensitive Utilities exist in the duplicate APF modules return, this is a finding.\n\nThe following list contains Sensitive Utilities that will be checked.\n\nAHLGTF AMASPZAP AMAZAP AMDIOCP AMZIOCP\nBLSROPTR CSQJU003 CSQJU004 CSQUCVX CSQUTIL\nCSQ1LOGP DEBE DITTO FDRZAPOP GIMSMP\nHHLGTF ICKDSF ICPIOCP IDCSC01 IEHINITT\nIFASMFDP IGWSPZAP IHLGTF IMASPZAP IND$FILE\nIOPIOCP IXPIOCP IYPIOCP IZPIOCP WHOIS\nL052INIT TMSCOPY TMSFORMT TMSLBLPR TMSMULV\nTMSREMOV TMSTPNIT TMSUDSNB","fixText":"Review and ensure that duplicate sensitive utility(ies) and/or program(s) do not exist in APF-authorized libraries. Identify all versions of the sensitive utilities contained in APF-authorized libraries listed in the above check. In cases where duplicates exist, ensure no exposure has been created and written justification has been filed with the ISSO.\n\nComparisons among all the APF libraries will be done to ensure that an exposure is not created by the existence of identically named modules. Address any sensitive utility concerns so that the function can be restricted as required.","ccis":["CCI-000381"]},{"vulnId":"V-223788","ruleId":"SV-223788r1028297_rule","severity":"high","ruleTitle":"The IBM z/OS systems requiring data-at-rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption.","description":"This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. Operating systems handling data requiring \"data at rest\" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest.\n\nSelection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).\n\nUse of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\n\nSatisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000405-GPOS-00184, SRG-OS-000404-GPOS-00183, SRG-OS-000396-GPOS-00176","checkContent":"Determine if IBM's DS8880 Disks or equivalent hardware solutions are in use.\n\nIf they are not in use for systems that require data at rest, this is a finding.","fixText":"Employ IBM's DS8880 hardware or equivalent hardware solutions to ensure full disk encryption.","ccis":["CCI-001199","CCI-002420","CCI-002445","CCI-002446"]},{"vulnId":"V-223792","ruleId":"SV-223792r958902_rule","severity":"medium","ruleTitle":"The IBM z/OS Policy Agent must contain a policy that protects against or limits the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.","checkContent":"Examine the Policy Agent policy statements. \n\nIf it can be determined that policy that protects against or limits the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces, this is not a finding.","fixText":"Develop Policy application and policy agent to protect against or limit the effects of denial-of-service (DoS) attacks by ensuring the operating system is implementing rate-limiting measures on impacted network interfaces.","ccis":["CCI-002385"]},{"vulnId":"V-223793","ruleId":"SV-223793r958528_rule","severity":"medium","ruleTitle":"The IBM z/OS Policy Agent must contain a policy that manages excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks.","description":"DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity.","checkContent":"Examine the Policy Agent policy statements. \n\nIf it can be determined that there are policy statements that manages excess capacity, this is not a finding.","fixText":"Develop Policy application and Policy agent to manage excess capacity.","ccis":["CCI-001095"]},{"vulnId":"V-223794","ruleId":"SV-223794r958404_rule","severity":"medium","ruleTitle":"The IBM z/OS must employ a session manager that conceals, via the session lock, information previously visible on the display with a publicly viewable image.","description":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined. The operating system session lock event must include an obfuscation of the display screen so as to prevent other users from reading what was previously displayed.\n\nPublicly viewable images can include static or dynamic images, for example, patterns used with screen savers, photographic images, solid colors, a clock, a battery life indicator, or a blank screen, with the additional caveat that none of the images convey sensitive information.","checkContent":"Ask the system administrator for the configuration parameters for the session manager in use.\n\nIf there is no session manager in use, this is a finding.\n\nIf the session manager is not configure to conceal, via the session lock, information previously visible on the display with a publicly viewable image, this is a finding.","fixText":"Configure the session manager to conceal, via the session lock, information previously visible on the display with a publicly viewable image.","ccis":["CCI-000060"]},{"vulnId":"V-223795","ruleId":"SV-223795r958402_rule","severity":"medium","ruleTitle":"IBM z/OS must employ a session manager to manage session lock after a 15-minute period of inactivity.","description":"A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, operating systems need to be able to identify when a user's session has idled and take action to initiate the session lock.","checkContent":"Ask the system administrator for the configuration parameters for the session manager in use.\n\nIf there is no session manager in use, this is a finding.\n\nIf the session manager is not configured to initiate session lock after a 15-minute period of inactivity, this is a finding.","fixText":"Configure the session manager to initiate a session lock after a 15-minute period of inactivity.","ccis":["CCI-000057"]},{"vulnId":"V-223796","ruleId":"SV-223796r998372_rule","severity":"medium","ruleTitle":"IBM z/OS must employ a session for users to directly initiate a session lock for all connection types.","description":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined. Rather than be forced to wait for a period of time to expire before the user session can be locked, operating systems need to provide users with the ability to manually invoke a session lock so users may secure their session should the need arise for them to temporarily vacate the immediate physical vicinity.","checkContent":"Ask the system administrator for the configuration parameters for the session manager in use.\n\nIf there is no session manager in use, this is a finding.\n\nIf the session manager in use does not allow users to directly initiate a session lock for all connection types, this is a finding.","fixText":"Develop a procedure to offload SMF files to a different system or media than the system being audited.","ccis":["CCI-000057"]},{"vulnId":"V-223797","ruleId":"SV-223797r958400_rule","severity":"medium","ruleTitle":"IBM z/OS must employ a session manager to manage retaining a users session lock until that user reestablishes access using established identification and authentication procedures.","description":"A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence.\n\nThe session lock is implemented at the point where session activity can be determined.\n\nRegardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system.","checkContent":"Ask the system administrator for the configuration parameters for the session manager in use.\n\nIf there is no session manager in use this is a finding.\n\nIf the session manager is not configured to retain a user's session lock until that user reestablishes access using established identification and authentication procedures, this is a finding.","fixText":"Configure the session manager to retain a user's session lock until that user reestablishes access using established identification and authentication procedures.","ccis":["CCI-000056"]},{"vulnId":"V-223798","ruleId":"SV-223798r998374_rule","severity":"medium","ruleTitle":"IBM z/OS system administrator must develop a procedure to remove or disable temporary user accounts after 72 hours.","description":"Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid account activation is required. Therefore, emergency account activation may bypass normal account authorization processes. If these accounts are automatically disabled, system maintenance during emergencies may not be possible, thus adversely affecting system availability. \n\nEmergency accounts are different from infrequently used accounts (i.e., local logon accounts used by the organization's system administrators when network or normal logon/access is not available). Infrequently used accounts are not subject to automatic termination dates. Emergency accounts are accounts created in response to crisis situations, usually for use by maintenance personnel. The automatic expiration or disabling time period may be extended as needed until the crisis is resolved; however, it must not be extended indefinitely. A permanent account should be established for privileged users who need long-term maintenance accounts.\n\nTo address access requirements, many operating systems can be integrated with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements.","checkContent":"Ask the system administrator (SA) for the procedure to automatically remove or disable temporary user accounts after 72 hours.\n\nIf there is no procedure, this is a finding.","fixText":"Develop a procedure to automatically remove or disable temporary user accounts after 72 hours.","ccis":["CCI-000016","CCI-003628"]},{"vulnId":"V-223800","ruleId":"SV-223800r958794_rule","severity":"medium","ruleTitle":"IBM z/OS system administrator must develop a procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.","description":"Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security.\n\nDetecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's IMO/ISSO and SAs must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item.","checkContent":"Ask the system administrator for the procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.\n\nIf there is no procedure, this is a finding.","fixText":"Develop a procedure to notify designated personnel if baseline configurations are changed in an unauthorized manner.","ccis":["CCI-001744"]},{"vulnId":"V-223801","ruleId":"SV-223801r958506_rule","severity":"medium","ruleTitle":"IBM z/OS system administrator must develop a procedure to provide an audit reduction capability that supports on-demand reporting requirements.","description":"The ability to generate on-demand reports, including after the audit data has been subjected to audit reduction, greatly facilitates the organization's ability to generate incident reports as needed to better handle larger-scale or more complex security incidents.\n\nAudit reduction is a process that manipulates collected audit information and organizes such information in a summary format that is more meaningful to analysts. The report generation capability provided by the application must support on-demand (i.e., customizable, ad hoc, and as-needed) reports.","checkContent":"Ask the system administrator for the procedure to provide an audit reduction capability that supports on-demand reporting requirements.\n\nIf there is no procedure, this is a finding.","fixText":"Develop a procedure to provide an audit reduction capability that supports on-demand reporting requirements.","ccis":["CCI-001876"]},{"vulnId":"V-223803","ruleId":"SV-223803r958936_rule","severity":"medium","ruleTitle":"IBM z/OS system administrator must develop a procedure to remove all software components after updated versions have been installed.","description":"Previous versions of software components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some information technology products may remove older versions of software automatically from the information system.","checkContent":"Ask the system administrator for the procedure to remove all software components after updated versions have been installed.\n\nIf there is no procedure, this is a finding.","fixText":"Develop a procedure to remove all software components after updated versions have been installed.","ccis":["CCI-002617"]},{"vulnId":"V-223804","ruleId":"SV-223804r958948_rule","severity":"medium","ruleTitle":"IBM z/OS must shut down the information system, restart the information system, and/or notify the system administrator when anomalies in the operation of any security functions are discovered.","description":"If anomalies are not acted upon, security functions may fail to secure the system. \n\nSecurity function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters.\n\nNotifications provided by information systems include messages to local computer consoles, and/or hardware indications, such as lights.\n\nThis capability must take into account operational requirements for availability for selecting an appropriate response. The organization may choose to shut down or restart the information system upon security function anomaly detection.","checkContent":"Ask the system administrator for the procedure to shut down the information system, restart the information system, and/or notify the system administrator when anomalies occur.\n\nIf a procedure does not exist, this is a finding.\n\nIf the procedure does not properly shut down the information system, restart the information system, and/or notify the system administrator when anomalies occur, this is a finding.","fixText":"Develop a procedure to shut down the information system, restart the information system, and/or notify the system administrator when anomalies occur.","ccis":["CCI-002702"]},{"vulnId":"V-223805","ruleId":"SV-223805r959008_rule","severity":"medium","ruleTitle":"IBM z/OS system administrator must develop a procedure to offload SMF files to a different system or media than the system being audited.","description":"Information stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOff-loading is a common process in information systems with limited audit storage capacity.","checkContent":"Ask the system administrator for the procedure to offload SMF files to a different system or media than the system being audited.\n\nIf the procedure does not exist, this is a finding.","fixText":"Develop a procedure to offload SMF files to a different system or media than the system being audited.","ccis":["CCI-001851"]},{"vulnId":"V-223806","ruleId":"SV-223806r958406_rule","severity":"medium","ruleTitle":"IBM z/OS SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events.","description":"SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised.\n\nSatisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000392-GPOS-00172","checkContent":"Locate the SSH daemon configuration file, which may be found in /etc/ssh/ directory.\n\nAlternately:\nFrom UNIX System Services ISPF Shell navigate to ribbon select tools.\nSelect option 1 - Work with Processes.\n\nIf SSH Daemon is not active, this is not a finding.\n\nExamine SSH daemon configuration file. \n\nIf ServerSMF is not coded with ServerSMF TYPE119_U83 or is commented out, this is a finding.","fixText":"Configure the SERVERSMF statement in the SSH Daemon configuration file to TYPE119_U83.","ccis":["CCI-000067","CCI-002884"]},{"vulnId":"V-223807","ruleId":"SV-223807r1083014_rule","severity":"high","ruleTitle":"The IBM RACF SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm to protect confidential information and remote access sessions.","description":"Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.\n\nRemote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nCryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.","checkContent":"Locate the SSH daemon configuration file, which may be found in /etc/ssh/ directory.\n\nAlternately:\nFrom the Unix System Services ISPF Shell, navigate to ribbon select tools.\nSelect option 1 - Work with Processes.\n\nIf SSH Daemon is not active, this is not a finding.\n\nExamine SSH daemon configuration file. \nsshd_config\n\nIf there are no \"Ciphers\" lines, or the ciphers list contains any cipher not starting with \"aes\", this is a finding.\n\nIf the MACs line is not configured to \"hmac-sha1\" or greater this is a finding.\n\nExamine the z/OS-specific sshd server systemwide configuration: \nzos_sshd_config\n\nIf any of the following is untrue, this is a finding.\n\nFIPSMODE=YES\nCiphersSource=ICSF\nMACsSource=ICSF","fixText":"Edit the SSH daemon configuration and remove any ciphers not starting with  \"aes\". If necessary, add a \"Ciphers\" line using FIPS 140-2 compliant algorithms.\n\nConfigure for message authentication to MACs \"hmac-sha1\" or greater.\n\nEdit the z/OS-specific sshd server systemwide configuration file configuration as follows:\nFIPSMODE=YES\nCiphersSource=ICSF\nMACsSource=ICSF","ccis":["CCI-000068","CCI-001453"]},{"vulnId":"V-223809","ruleId":"SV-223809r958586_rule","severity":"medium","ruleTitle":"The SSH daemon must be configured with the Standard Mandatory DoD Notice and Consent Banner.","description":"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.\n\nSystem use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.\n\nThe banner must be formatted in accordance with applicable DoD policy. Use the following verbiage for operating systems that can accommodate banners of 1300 characters:\n\n\"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\"\n\nUse the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner:\n\n\"I've read & consent to terms in IS user agreem't.\"","checkContent":"Locate the SSH daemon configuration file, which may be found in /etc/ssh/ directory.\n\nAlternately:\nFrom UNIX System Services ISPF Shell navigate to ribbon select tools.\n\nSelect option 1 - Work with Processes.\n\nIf SSH Daemon is not active, this is not a finding.\n\nExamine SSH daemon configuration file.\n\nIf Banner statement is missing or configured to none, this is a finding.\n\nEnsure that the contents of the file specified on the banner statement contain a logon banner.\n\nThe banner below is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. If there is any deviation this is a finding.\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.","fixText":"Configure the banner statement to a file that contains the Department of Defense (DoD) logon banner.\n\nEnsure that the contents of the file specified on the banner statement contain a logon banner.\nThe below banner is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. \n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.","ccis":["CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"]},{"vulnId":"V-223810","ruleId":"SV-223810r958480_rule","severity":"high","ruleTitle":"IBM z/OS SSH daemon must be configured to only use the SSHv2 protocol.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.","checkContent":"Locate the SSH daemon configuration file, which may be found in /etc/ssh/ directory.\n\nAlternately:\nFrom UNIX System Services ISPF Shell navigate to ribbon select tools.\nSelect option 1 - Work with Processes.\n\nIf SSH Daemon is not active, this is not a finding.\n\nExamine SSH daemon configuration file. If the variables \"Protocol 2,1\" or \"Protocol 1\" are defined on a line without a leading comment, this is a finding.","fixText":"Edit the sshd_config file and set the \"Protocol\" setting to \"2\".","ccis":["CCI-000382"]},{"vulnId":"V-223811","ruleId":"SV-223811r998380_rule","severity":"medium","ruleTitle":"IBM z/OS, for PKI-based authentication, must use the ICSF or ESM for key management.","description":"Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.","checkContent":"Any keys or Certificates must be managed in ICSF or the external security manager and not in UNIX files.\n\nFrom the ISPF Command Shell enter:\nOMVS\nenter\nfind / -name *.kdb\nand\nfind / -name *.jks\n\nIf any files are present, this is a finding.","fixText":"Define all Keys/Certificates to ICSF or the security database.\n\nRemove all .kdb and .jks key files.","ccis":["CCI-000187","CCI-004910"]},{"vulnId":"V-223812","ruleId":"SV-223812r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS permission bits and user audit bits for HFS objects that are part of the Syslog daemon component must be properly configured.","description":"HFS directories and files of the Syslog daemon provide the configuration and executable properties of this product. Failure to properly secure these objects could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.","checkContent":"From an ISPF \nEnter\ncd /usr/sbin\nEnter\nls -alW\n\nIf File Permission Bits and User Audit Bits for SYSLOG Daemon HFS directories and files is as below, this is not a finding.\n/usr/sbin/syslogd 1740 fff\n\nEnter\ncd /etc/\nEnter\nls -alW\n\nIf the file Permission Bits and User Audit Bits for Output log file defined in the configuration file are as below, this is not a finding.\n/etc/syslog.conf 0744 faf\n0744 fff\n\nNotes:\nThe /usr/sbin/syslogd object is a symbolic link to /usr/lpp/tcpip/sbin/syslogd. The permission and user audit bits on the target of the symbolic link must have the required settings.\nThe /etc/syslog.conf file may not be the configuration file the daemon uses. It is necessary to check the script or JCL used to start the daemon to determine the actual configuration file. For example, in /etc/rc:\n_BPX_JOBNAME='SYSLOGD' /usr/sbin/syslogd -f /etc/syslog.conf\n\nFor example, in the SYSLOGD started task JCL:\n//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT \n// PARM='POSIX(ON) ALL31(ON)/ -f /etc/syslogd.conf'\n\n//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT \n// PARM='POSIX(ON) ALL31(ON) /-f //''SYS1.TCPPARMS(SYSLOG)'''\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"Configure the UNIX permission bits and user audit bits on the HFS directories and files for the Syslog daemon to conform to the specifications in the SYSLOG Daemon HFS Object Security Settings table below.\n\nLog files should have security that prevents anyone except the syslogd process and authorized maintenance jobs from writing to or deleting them. \n\nA maintenance process to periodically clear the log files is essential. Logging stops if the target file system becomes full.\n\nSYSLOG Daemon HFS Object Security Settings\nFile Permission Bits User Audit Bits\n/usr/sbin/syslogd 1740 fff\n[Configuration File]\n/etc/syslog.conf 0744 faf\n[Output log file defined in the configuration file]\n0744 fff\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nNOTES:\nThe /usr/sbin/syslogd object is a symbolic link to /usr/lpp/tcpip/sbin/syslogd. The permission and user audit bits on the target of the symbolic link must have the required settings.\n\nThe /etc/syslog.conf file may not be the configuration file the daemon uses. It is necessary to check the script or JCL used to start the daemon to determine the actual configuration file. For example, in /etc/rc:\n\n_BPX_JOBNAME='SYSLOGD' /usr/sbin/syslogd -f /etc/syslog.conf\n\nFor example, in the SYSLOGD started task JCL:\n\n//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT \n// PARM='POSIX(ON) ALL31(ON)/ -f /etc/syslogd.conf'\n\n//SYSLOGD EXEC PGM=SYSLOGD,REGION=30M,TIME=NOLIMIT \n// PARM='POSIX(ON) ALL31(ON) /-f //''SYS1.TCPPARMS(SYSLOG)'''\n\nThe following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 1740 /usr/lpp/tcpip/sbin/syslogd\nchaudit rwx=f /usr/lpp/tcpip/sbin/syslogd\nchmod 0744 /etc/syslog.conf\nchaudit w=sf,rx+f /etc/syslog.conf\nchmod 0744 /log_dir/log_file\nchaudit rwx=f /log_dir/log_file","ccis":["CCI-000213"]},{"vulnId":"V-223813","ruleId":"SV-223813r958482_rule","severity":"medium","ruleTitle":"The IBM z/OS Syslog daemon must be started at z/OS initialization.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"SYSLOGD may be started from the shell, a cataloged procedure (STC), or the BPXBATCH program. Additionally, other mechanisms (e.g., a job scheduler) may be used to automatically start the Syslog daemon. To thoroughly analyze this requirement you may need to view the OS SYSLOG using SDSF, find the last IPL, and look for the initialization of SYSLOGD.\n\nIf the Syslog daemon SYSLOGD is started automatically during the initialization of the z/S/ system, this is not a finding.","fixText":"Review the files used to initialize tasks during system IPL (e.g., /etc/rc, SYS1.PARMLIB, any job scheduler definitions) configure the Syslog daemon to start automatically during z/OS system initialization.\n\nIt is important that syslogd be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. As with other z/OS UNIX daemons, there is more than one way to start SYSLOGD. It can be started as a process in the /etc/rc file or as a z/OS started task.","ccis":["CCI-000764"]},{"vulnId":"V-223814","ruleId":"SV-223814r1196251_rule","severity":"medium","ruleTitle":"The IBM z/OS Syslog daemon must be properly defined and secured.","description":"The Syslog daemon, known as syslogd, is a z/OS Unix daemon that provides a central processing point for log messages issued by other z/OS Unix processes. It is also possible to receive log messages from other network-connected hosts. Some of the IBM Communications Server components that may send messages to syslog are the FTP, z/OS Unix Telnet, DNS, and DHCP servers. The messages may be of varying importance and may include general process information, diagnostic information, critical error notification, and audit-class information. There is a security interest in protecting the syslogd process and its associated data because of the potential to use this information in an audit process. \n\nThe Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.","checkContent":"From z/OS command screen enter: \nListUser SYSLOGD OMVS (SYSLOGD is usual name of the SYSLOG daemon)\n\nIf all of the following are true, this is not a finding.\n\nIf either of the following is untrue, this is a finding.\n\n-The SYSLOGD userid is defined as a PROTECTED userid.\n-The SYSLOGD userid has the following z/OS Unix attributes: UID(0), HOME directory '/', shell program /bin/sh.\n\nFrom z/OS command screen enter:\nRList STARTED SYSLOGD\n\nIf a matching entry in the STARTED resource class exists enabling the use of the standard userid and appropriate group, this is not a finding.","fixText":"The Syslog daemon userid is SYSLOGD.\nDefine the SYSLOGD userid as a PROTECTED userid.\nDefine the SYSLOGD userid has UID(0), HOME('/'), and PROGRAM('/bin/sh') specified in the OMVS segment.\n\nTo set up and use as an MVS Started Proc, the following sample commands are provided:\n\nAU SYSLOGD NAME('stc, tcpip') NOPASSWORD NOOIDCARD DFLTGRP(STC) -\nOWNER(STC) DATA('Reference ISLG0020 for proper setup ')\nALU SYSLOGD DFLTGRP(stctcpx) \nALU SYSLOGD OMVS(UID(0) HOME('/') PROGRAM('/bin/sh')) \nCO SYSLOGD GROUP(stctcpx) OWNER(stctcpx)\n\nA matching entry mapping the SYSLOGD started proc to the SYSLOGD userid is in the STARTED resource class.\n\nRDEF STARTED SYSLOGD.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER(SYSLOGD) GROUP(STC)) \n\nIf /etc/rc is used to start the Syslog daemon, ensure that the _BPX_JOBNAME and _BPX_ USERID environment variables are assigned a value of SYSLOGD.","ccis":["CCI-000764"]},{"vulnId":"V-223815","ruleId":"SV-223815r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS DFSMS Program Resources must be properly defined and protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"Refer to the load modules residing in the following Load libraries to determine program resource definitions:\n SYS1.DGTLLIB for DFSMSdfp/ISMF\n SYS1.DGTLLIB for DFSMSdss/ISMF\n SYS1.DFQLLIB for DFSMShsm\n\nIf the installation moves these modules to another load library, the installation-defined load library must be used in the program protection.\n\nIf the RACF resources are defined with a default access of NONE, this is not a finding.\n\nIf the RACF resource access authorizations restrict access to the appropriate personnel, this is not a finding. \n\n(Refer to the chapter titled \"Protecting the Storage Management Subsystem\" in the IBM z/OS DFSMSdfp Storage Administration Guide to assist with guidance on appropriate access.)","fixText":"(Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nRefer to the chapter titled \"Protecting the Storage Management Subsystem\" in the IBM z/OS DFSMSdfp Storage Administration Guide.\n\nUse SMS Program Resources tables to determine the resources and access requirements for SMS Program Resources. Ensure the guidelines for the resource type, resources, and/or generic equivalent are specified.\n\nThe RACF resources as designated in the table above are defined with a default access of NONE.\n\nThe RACF resource access authorizations restrict access to the appropriate personnel as designated in the table above.\n\nThe following commands are provided as a sample for implementing resource controls:\n\nRDEF PROGRAM ACBFUTO2 ADDMEM('SYS1.DSF.DGTLLIB'//NOPADCHK) - \nDATA('ADDED PER SRR PDI ZSMS0012 ') - \nAUDIT(FAILURE(READ)) UACC(NONE) OWNER(ADMIN)\nPERMIT ACBFUTO2 CLASS(PROGRAM) ID(********)","ccis":["CCI-000213"]},{"vulnId":"V-223816","ruleId":"SV-223816r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS DFSMS control data sets must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"Review the logical parmlib data sets, example: SYS1.PARMLIB(IGDSMSxx), to identify the fully qualified file names for the following SMS data sets:\n\nSource Control Data Set (SCDS)\nActive Control Data Set (ACDS)\nCommunications Data Set (COMMDS)\nAutomatic Class Selection Routine Source Data Sets (ACS)\nACDS Backup\nCOMMDS Backup\n\nIf the RACF data set rules for the SCDS, ACDS, COMMDS, and ACS data sets restrict WRITE or greater access to only systems programming personnel, this is not a finding.\n\nIf the RACF data set rules for the SCDS, ACDS, COMMDS, and ACS data sets do not restrict WRITE or greater access to only systems programming personnel, this is a finding.\n\nNote: At the discretion of the ISSM, DASD administrators are allowed UPDATE access to the control datasets.","fixText":"Review the SYS1.PARMLIB(IGDSMS00) data set to identify the fully qualified file names for the following SMS data sets:\n\nSource Control Data Set (SCDS)\nActive Control Data Set (ACDS)\nCommunications Data Set (COMMDS)\nAutomatic Class Selection Routine Source Data Sets (ACS)\nACDS Backup\nCOMMDS Backup\n\nConfigure the RACF data set rules for the SCDS, ACDS, COMMDS, and ACS data sets to restrict WRITE or greater access to only z/OS systems programming personnel.\n\nNote: At the discretion of the ISSM, DASD administrators are allowed UPDATE access to the control datasets.\n\nSome example commands to implement the proper controls are shown here:\n\nAD 'sys3.dfsms.mmd.commds.**' UACC(NONE) OWNER(SYS3) AUDIT(ALL(READ)) DATA('PROTECTED PER ZSMS0020')\n\nPE 'sys3.dfsms.mmd.commds.**' ID(<syspsmpl>) ACC(A)","ccis":["CCI-000213"]},{"vulnId":"V-223817","ruleId":"SV-223817r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS DFSMS-related RACF classes must be active.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From an ISPF Command Shell enter:\nSETRopts list\n\nIf ACTIVE CLASSES lists the MGMTCLAS, STORCLAS, PROGRAM, and FACILITY resources classes, this is not a finding.","fixText":"Configure SETRopts to include MGMTCLAS, STORCLAS, PROGRAM, and FACILITY resources classes as ACTIVE.\n\nThe classes can be activated with the command:\nSETR CLASSACT(MGMTCLAS STORCLAS PROGRAM FACILITY)\n\nThe classes can be RACLISTED with the command:\nSETR RACL(MGMTCLAS STORCLAS)","ccis":["CCI-000213"]},{"vulnId":"V-223818","ruleId":"SV-223818r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS DFSMS resources must be protected in accordance with the proper security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000324-GPOS-00125","checkContent":"If all SMS resources and/or generic equivalent are properly protected according to the requirements specified and the following guidance is true, this is not a finding.\n\nThe STGADMIN.** profile in the FACILITY resource class has a default access of NONE and no access is granted at this level.\n\nSTGADMIN.DPDSRN.olddsname is restricted to system programmers and all access is logged.\n\nThe STGADMIN.IGD.ACTIVATE.CONFIGURATION is restricted to system programmers and all access is logged.\n\nThe STGADMIN.IGG.DEFDEL.UALIAS is restricted to Centralized and Decentralized Security personnel and system programmers and all access is logged.\n\nThe resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE is defined with access of NONE.\n\nNote: The resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE can be defined with read access for migration purposes. If it is a detailed migration plan must be documented and filed by the ISSM that determines a definite migration period. All access must be logged. At the completion of migration this resource must be configured with access = NONE.\n\nThe following resources and prefixes may be available to the end user.\n\nSTGADMIN.ADR.COPY.CNCURRNT\nSTGADMIN.ADR.COPY.FLASHCPY\nSTGADMIN.ADR.COPY.TOLERATE.ENQF\nSTGADMIN.ADR.DUMP.CNCURRNT\nSTGADMIN.ADR.DUMP.TOLERATE.ENQF\nSTGADMIN.ADR.RESTORE.TOLERATE.ENQF\nSTGADMIN.ARC.ENDUSER.*\nSTGADMIN.IGG.ALTER.SMS\n\nThe following resource is restricted to Application Production Support Team members, Automated Operations, DASD managers, and system programmers.\n\nSTGADMIN.IDC.DCOLLECT\n\nThe following resources are restricted to Application Production Support Team members, DASD managers, and system programmers.\n\nSTGADMIN.ARC.CANCEL\nSTGADMIN.ARC.LIST\nSTGADMIN.ARC.QUERY\nSTGADMIN.ARC.REPORT\nSTGADMIN.DMO.CONFIG\nSTGADMIN.IFG.READVTOC\nSTGADMIN.IGG.DELGDG.FORCE\n\nThe following resource prefixes, at a minimum, are restricted to DASD managers and system programmers.\n\nSTGADMIN.ADR\nSTGADMIN.ANT\nSTGADMIN.ARC\nSTGADMIN.DMO\nSTGADMIN.ICK\nSTGADMIN.IDC\nSTGADMIN.IFG\nSTGADMIN.IGG\nSTGADMIN.IGWSHCDS\n\nThe following Storage Administrator functions prefix is restricted to DASD managers and system programmers and all access is logged.\n\nSTGADMIN.ADR.STGADMIN.*","fixText":"(Note: The resources and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nBelow is listed the access requirements for SMS Resources. Configure the resources and/or generic equivalent are followed.\n\nThe RACF resources are defined with a default access of NONE.\n\nThe RACF resource rules for the resources specify UACC(NONE) and NOWARNING.\n\nEnsure that no access is given to the high-level STGADMIN resource.\n\nExample:\nRDEF FACILITY STGADMIN.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nEnsure no access is given to resource STGADMIN.IGG.CATALOG.SECURITY.CHANGE.*\n\nExample:\nRDEF FACILITY STGADMIN.IGG.CATALOG.SECURITY.CHANGE OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nThe STGADMIN.DPDSRN.olddsname is restricted to system programmers and all access is logged.\n\nExample:\nRDEF FACILITY STGADMIN.DPDSRN.olddsname OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nPE STGADMIN.DPDSRN.olddsname CL(FACILITY) ID(syspsmpl)\n\nThe STGADMIN.IGD.ACTIVATE.CONFIGURATION is restricted to system programmers and all access is logged.\n\nExample:\nRDEF FACILITY STGADMIN.IGD.ACTIVATE.CONFIGURATION OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nPE STGADMIN.IGD.ACTIVATE.CONFIGURATION CL(FACILITY) ID(syspsmpl)\n\nThe STGADMIN.IGG.DEFDEL.UALIAS is restricted to System Programmers and Security personnel and all access is logged.\n\nExample:\nRDEF FACILITY STGADMIN.IGG.DEFDEL.UALIAS OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nPE STGADMIN.IGG.DEFDEL.UALIAS CL(FACILITY) ID(secasmpl)\nPE STGADMIN.IGG.DEFDEL.UALIAS CL(FACILITY) ID(secdsmpl)\nPE STGADMIN.IGG.DEFDEL.UALIAS CL(FACILITY) ID(syspsmpl)\n\nThe following resources and prefixes may be available to the end user.\n\nSTGADMIN.ADR.COPY.CNCURRNT\nSTGADMIN.ADR.COPY.FLASHCPY\nSTGADMIN.ADR.COPY.TOLERATE.ENQF\nSTGADMIN.ADR.DUMP.CNCURRNT\nSTGADMIN.ADR.DUMP.TOLERATE.ENQF\nSTGADMIN.ADR.RESTORE.TOLERATE.ENQF\nSTGADMIN.ARC.ENDUSER.*\nSTGADMIN.IGG.ALTER.SMS\n\nExample:\nRDEF FACILITY STGADMIN.ADR.COPY.CNCURRNT.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(FAILURE(READ))\n\nPE STGADMIN.ADR.COPY.CNCURRNT.** CL(FACILITY) ID(endusers)\n\nThe following resource is restricted to Application Production Support Team members, Automated Operations, DASD managers, and system programmers.\n\nSTGADMIN.IDC.DCOLLECT\n\nExample:\nRDEF FACILITY STGADMIN.IDC.DCOLLECT.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(FAILURE(READ))\n\nPE STGADMIN.IDC.DCOLLECT.** CL(FACILITY) ID(appssmpl)\nPE STGADMIN.IDC.DCOLLECT.** CL(FACILITY) ID(autosmpl)\nPE STGADMIN.IDC.DCOLLECT.** CL(FACILITY) ID(dasbsmpl)\nPE STGADMIN.IDC.DCOLLECT.** CL(FACILITY) ID(dasdsmpl)\nPE STGADMIN.IDC.DCOLLECT.** CL(FACILITY) ID(syspsmpl)\n\nThe following resources are restricted to Application Production Support Team members, DASD managers, and system programmers.\n\nSTGADMIN.ARC.CANCEL\nSTGADMIN.ARC.LIST\nSTGADMIN.ARC.QUERY\nSTGADMIN.ARC.REPORT\nSTGADMIN.DMO.CONFIG\nSTGADMIN.IFG.READVTOC\nSTGADMIN.IGG.DELGDG.FORCE\n\nExample:\nRDEF FACILITY STGADMIN.ARC.CANCEL.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(FAILURE(READ))\n\nPE STGADMIN.ARC.CANCEL.** CL(FACILITY) ID(appssmpl)\nPE STGADMIN.ARC.CANCEL.** CL(FACILITY) ID(dasbsmpl)\nPE STGADMIN.ARC.CANCEL.** CL(FACILITY) ID(dasdsmpl)\nPE STGADMIN.ARC.CANCEL.** CL(FACILITY) ID(syspsmpl)\n\nThe following resource prefixes, at a minimum, are restricted to DASD managers and system programmers.\n\nSTGADMIN.ADR\nSTGADMIN.ANT\nSTGADMIN.ARC\nSTGADMIN.DMO\nSTGADMIN.ICK\nSTGADMIN.IDC\nSTGADMIN.IFG\nSTGADMIN.IGG\nSTGADMIN.IGWSHCDS\n\nExample:\nRDEF FACILITY STGADMIN.ADR.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(FAILURE(READ))\n\nPE STGADMIN.ADR.** CL(FACILITY) ID(dasbsmpl)\nPE STGADMIN.ADR.** CL(FACILITY) ID(dasdsmpl)\nPE STGADMIN.ADR.** CL(FACILITY) ID(syspsmpl)\n\nThe following Storage Administrator functions prefix is restricted to DASD managers and system programmers and all access is logged.\n\nSTGADMIN.ADR.STGADMIN.*\n\nExample:\nRDEF FACILITY STGADMIN.ADR.STGADMIN.** OWNER(ADMIN) -\nUACC(NONE) AUDIT(ALL(READ))\n\nPE STGADMIN.ADR.STGADMIN.** CL(FACILITY) ID(dasbsmpl)\nPE STGADMIN.ADR.STGADMIN.** CL(FACILITY) ID(dasdsmpl)\nPE STGADMIN.ADR.STGADMIN.** CL(FACILITY) ID(syspsmpl)","ccis":["CCI-000213","CCI-002235"]},{"vulnId":"V-223819","ruleId":"SV-223819r991589_rule","severity":"medium","ruleTitle":"IBM z/OS using DFSMS must properly specify SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Review the logical parmlib data sets, example: SYS1.PARMLIB(IGDSMSxx), for the following SMS parameter settings:\n\nParameter Key\nSMS\nACDS(ACDS data set name)\nCOMMDS(COMMDS data set name)\n\nIf the required parameters are defined, this is not a finding.","fixText":"Configure the DFSMS-related PDS members and statements specified in the system parmlib concatenation as outlined below:\n\nParameter Key\nSMS\nACDS(ACDS data set name)\nCOMMDS(COMMDS data set name)","ccis":["CCI-000366"]},{"vulnId":"V-223820","ruleId":"SV-223820r958406_rule","severity":"medium","ruleTitle":"IBM z/OS PROFILE.TCPIP configuration statements for the TCP/IP stack must be coded properly.","description":"Remote access services, such as those providing remote access to network devices and information systems, which lack automated monitoring capabilities, increase risk and make remote user access management difficult at best.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nAutomated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).","checkContent":"Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.\n\nIf the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file, this is not a finding.\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nThe SMFPARMS statement is not coded or commented out.\nThe DELETE statement is not coded or commented out for production systems.\nThe SMFCONFIG statement is coded with (at least) the FTPCLIENT and TN3270CLIENT operands.\nThe TCPCONFIG and UDPCONFIG statements are coded with (at least) the RESTRICTLOWPORTS operand.\nIf the TCPCONFIG  does not have the TTLS statement coded, this is a finding.\n\nNOTE: If the INCLUDE statement is coded, the data set specified will be checked for access authorization compliance.","fixText":"Ensure the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file:\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nThe SMFPARMS statement is not coded or commented out.\nThe DELETE statement is not coded or commented out for production systems.\nThe SMFCONFIG statement is coded with (at least) the FTPCLIENT and TN3270CLIENT operands.\nThe TCPCONFIG and UDPCONFIG statements are coded with (at least) the RESTRICTLOWPORTS operand.\n\nNOTE: If the INCLUDE statement is coded, the data set specified will be checked for access authorization compliance in STIG ID ITCP0070.\n\nBASE TCP/IP PROFILE.TCPIP CONFIGURATION STATEMENTS\nFUNCTIONS\n\nINCLUDE- Specifies the name of an MVS data set that contains additional PROFILE.TCPIP statements to be used\n- Alters the configuration specified by previous statements\n\nSMFPARMS- Specifies SMF logging options for some TCP applications; replaced by SMFCONFIG\n- Controls collection of audit data\n\nDELETE- Specifies some previous statements, including PORT and PORTRANGE, that are to be deleted\n- Alters the configuration specified by previous statements\n\nSMFCONFIG- - Specifies SMF logging options for Telnet, FTP, TCP, API, and stack activity\n- Controls collection of audit data\n\nTCPCONFIG- Specifies various settings for the TCP protocol layer of TCP/IP\n- Controls port access   \n\nTCPCONFIG coded with TTLS - Specifies that the AT-TLS function is activated for the TCP/IP stack. The AT-TLS function provides invocation of System SSL in the TCP transport layer of the stack. \n\nNote: If AT-TLS is enabled, users must activate the SERVAUTH class, define the INITSTACK resource profile, and permit users to it.\n\nNOTE: If the INCLUDE statement is coded, the data set specified will be checked for access authorization compliance.","ccis":["CCI-000067"]},{"vulnId":"V-223821","ruleId":"SV-223821r958672_rule","severity":"medium","ruleTitle":"IBM z/OS must be configured to restrict all TCP/IP ports to ports, protocols, and/or services as defined in the PPSM CAL and vulnerability assessments.","description":"Remote access services, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and make remote user access management difficult at best.\n\nRemote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.\n\nOperating system functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of information system components (e.g., servers, workstations, notebook computers, smartphones, and tablets).","checkContent":"Refer the TCP/IP PROFILE DD statement to determine the TCP/IP Ports. If the PROFILE DD statement is not supplied, use the default search order to find the PROFILE data set. \n\nSee the IP Configuration Guide for a description of the search order for PROFILE.TCPIP. \n\nIf the all the Ports included in the configuration are restricted to the ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments, this is not a finding.","fixText":"Configure TCP/IP PROFILE port definitions to adhere to ports, protocols, and/or services, as defined in the Ports, Protocols, and Services Management (PPSM) Category Assurance List (CAL) and vulnerability assessments.","ccis":["CCI-002314"]},{"vulnId":"V-223822","ruleId":"SV-223822r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be properly configured.","description":"HFS directories and files of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.","checkContent":"From the ISPF Command Shell enter:\nomvs\n\nAt the input line enter:\ncd /etc\nenter\nls -alW\n\nIf the following file permission and user Audit Bits are true, this is not a finding.\n\n/etc/hosts 0744 faf\n/etc/protocol 0744 faf\n/etc/resolv.conf 0744 faf\n/etc/services 0740 faf\n\ncd /usr\nls -alW\n\nIf the following file permission and user Audit Bits are true, this is not a finding.\n\n/usr/lpp/tcpip/sbin 0755 faf\n/usr/lpp/tcpip/bin 0755 faf\n\nNotes: Some of the files listed above are not used in every configuration. The absence of a file is not considered a finding.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"With the assistance of a systems programmer with UID(0) and/or SUPERUSER access, configure the UNIX permission bits and user audit bits on the HFS directories and files for the FTP Server to conform to the specifications in the table below:\n\nBASE TCP/IP HFS Object Security Settings\nFile Permission Bits User Audit Bits\n/etc/hosts 0744 faf\n/etc/protocol 0744 faf\n/etc/resolv.conf 0744 faf\n/etc/services 0740 faf\n/usr/lpp/tcpip/sbin 0755 faf\n/usr/lpp/tcpip/bin 0755 faf\n\nSome of the files listed above (e.g., /etc/resolv.conf) are not used in every configuration. While the absence of a file is generally not a security issue, the existence of a file that has not been properly secured can often be an issue. Therefore, all directories and files that do exist will have the specified permission and audit bit settings.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nThe following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 0744 /etc/hosts\nchaudit w=sf,rx+f /etc/hosts\nchmod 0744 /etc/protocol\nchaudit w=sf,rx+f /etc/protocol\nchmod 0744 /etc/resolv.conf\nchaudit w=sf,rx+f /etc/resolv.conf\nchmod 0740 /etc/services\nchaudit w=sf,rx+f /etc/services\nchmod 0755 /usr/lpp/tcpip/bin\nchaudit w=sf,rx+f /usr/lpp/tcpip/bin\nchmod 0755 /usr/lpp/tcpip/sbin\nchaudit w=sf,rx+f /usr/lpp/tcpip/sbin","ccis":["CCI-000213"]},{"vulnId":"V-223823","ruleId":"SV-223823r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS TCP/IP resources must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRLIST SERVAUTH * ALL \n\nIf the following guidance is true, this is not a finding.\n\nThe EZA, EZB, and IST resources and/or generic equivalent are defined to the SERVAUTH resource class with a UACC(NONE).\n\nNo access is given to the EZA, EZB, and IST high level resources of the SERVAUTH resource class.\n\nIf the product CSSMTP is on the system, no access is given to EZB.CSSMTP of the SERVAUTH resource class.\n\nIf the product CSSMTP is on the system, EZB.CSSMTP.sysname.writername.JESnode will be specified and made available to the CSSMTP started task and authenticated users that require access to use CSSMTP for email services.\n\nAuthenticated users that require access will be permitted access to the second level of the resources in the SERVAUTH resource class. Examples are the network (NETACCESS), port (PORTACCESS), stack (STACKACCESS), and FTP resources in the SERVAUTH resource class.\n\nThe EZB.STACKACCESS. resource access authorizations restrict access to those started tasks with valid requirements and users with valid FTP access requirements.\n\nThe EZB.FTP.*.*.ACCESS.HFS) resource access authorizations restrict access to FTP users with specific written documentation showing a valid requirement exists to access OMVS files and Directories.\n\nThe EZB.INITSTACK.sysname.tcpname resource access authorizations restrict access before policies have been installed, to users authorized by the system security plan requiring access to the TCP/IP stack.","fixText":"Develop a plan of action to implement the required changes. Ensure the following items are in effect for TCP/IP resources.\n\n(Note: The resource class, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource class, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nEnsure that the EZA, EZB, and IST resources and/or generic equivalent are defined to the SERVAUTH resource class with a UACC(NONE).\n\nNo access is given to the EZA, EZB, and IST resources of the SERVAUTH resource class.\n\nIf the product CSSMTP is on the system, no access is given to EZB.CSSMTP of the SERVAUTH resource class. EZB.CSSMTP.sysname.writername.JESnode will be specified and made available to the CSSMTP started task and authenticated users that require access to use CSSMTP for e-mail services.\n\nOnly authenticated users that require access are permitted access to the second level of the resources in the SERVAUTH resource class. Examples are the network (NETACCESS), port (PORTACCESS), stack (STACKACCESS), and FTP resources in the SERVAUTH resource class.\n\nThe EZB.STACKACCESS. resource access authorizations restrict access to those started tasks with valid requirements and users with valid FTP access requirements.\n\nThe EZB.FTP.*.*.ACCESS.HFS) resource access authorizations restrict access to FTP users with specific written documentation showing a valid requirement exists to access OMVS files and Directories.\n\nThe EZB.INITSTACK.sysname.tcpname resource access authorizations restrict access to TCP/IP stack before policies have been installed to users authorized by the system security plan.\n\nThe following commands are provided as a sample for implementing resource controls:\n\nRDEF SERVAUTH EZB.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.CSSMTP.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.CSSMTP.sysname.writername.JESnode UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.FTP.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.NETACCESS.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.PORTACCESS.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.STACKACCESS.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\nRDEF SERVAUTH EZB.INITSTACK.**  UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ))\n\nPE EZB.CSSMTP.sysname.writername.JESnode CL(SERVAUTH) ID(authusers) ACC(READ)\nPE EZB.FTP.** CL(SERVAUTH) ID(authusers) ACC(READ)\nPE EZB.FTP.sysname.ftpstc.ACCESS.HFS CL(SERVAUTH) ID(ftpprofile) ACC(READ)\nPE EZB.NETACCESS.** CL(SERVAUTH) ID(authusers) ACC(READ)\nPE EZB.PORTACCESS.** CL(SERVAUTH) ID(authusers) ACC(READ)\nPE EZB.STACKACCESS.** CL(SERVAUTH) ID(authusers) ACC(READ)\nPE EZB.STACKACCESS.sysname.TCPIP CL(SERVAUTH) ID(ftpprofile) ACC(READ)\n\nPE EZB.INITSTACK.** CL (SERVAUTH) ID(authusers)  ACC(READ)\n\nThe following notes apply to these controls:\n\n- EZB.STACKACCESS.sysname.TCPIP access READ should be limited to only those started tasks that require access to the TCPIP Stack as well as any users approved for FTP Access (inbound and/or outbound). FTP users should not have access to the EZB.FTP.sysname.ftpstc.ACCESS.HFS resource unless specific written justification documenting valid requirement for those FTP users to access USS files and directories via FTP. \n\n- To be effective in restricting access, the network (EZB.NETACCESS) resource control requires configuration of the NETACCESS statement in the PROFILE.TCPIP file.\n\n- To be effective in restricting access, the port (EZB.PORTACCESS) resource control requires configuration of a PORT or PORTRANGE statement in the PROFILE.TCPIP file. These port definitions within PROFILE.TCPIP must be defined to include SAF keyword and a valid name. \n\nA list of possible SERVAUTH resources defined to the first two nodes is shown here: (Note that additional resources may be developed with each new release of TCPIP.)\n\nEZA.DCAS.\nEZB.BINDDVIPARANGE.\nEZB.CIMPROV.\nEZB.FRCAACCESS.\nEZB.FTP.\nEZB.INITSTACK.\nEZB.IOCTL.\nEZB.IPSECCMD.\nEZB.MODDVIPA.\nEZB.NETACCESS.\nEZB.NETMGMT.\nEZB.NETSTAT.\nEZB.NSS.\nEZB.NSSCERT.\nEZB.OSM.\nEZB.PAGENT.\nEZB.PORTACCESS.\nEZB.RPCBIND.\nEZB.SOCKOPT.\nEZB.SNMPAGENT.\nEZB.STACKACCESS.\nEZB.TN3270.\nIST.NETMGMT.","ccis":["CCI-000213"]},{"vulnId":"V-223824","ruleId":"SV-223824r1137691_rule","severity":"medium","ruleTitle":"The IBM RACF SERVAUTH resource class must be active for TCP/IP resources.","description":"IBM Provides the SERVAUTH Class for use in protecting a variety of TCP/IP features/functions/products both IBM and third-party. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.","checkContent":"From a command input screen enter:\nSETROPTS LIST\n\nIf there are TCP/IP resources defined and the SERVAUTH resource class is not active, this is a finding.","fixText":"Configure RACF SETROPTS to have the SERVAUTH resource class is active.\n\nEvaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below: \n\nThe RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe SERVAUTH Class is activated with the command SETR CLASSACT (SERVAUTH).\n\nGeneric profiles and commands should also be enabled with the command SETR GENERIC(SERVAUTH) GENCMD(SERVAUTH).","ccis":["CCI-000213"]},{"vulnId":"V-223826","ruleId":"SV-223826r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS data sets for the Base TCP/IP component must be properly protected.","description":"MVS data sets of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.\n\nTo mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"Execute a dataset access list for Base TCP/IP component datasets.\n\nIf the following items are true, this is not a finding.\n\nWRITE and ALLOCATE access to product data sets is restricted to systems programming personnel (i.e., SMP/E distribution data sets with the prefix SYS1.TCPIP.AEZA and target data sets with the prefix SYS1.TCPIP.SEZA).\n\nWRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is restricted to systems programming personnel.\n\nNote: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same access authorization requirements. \n\nWRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is logged.\n\nNote: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same logging requirements.\n\nWRITE and ALLOCATE access to the data set(s) containing the configuration files shared by TCP/IP applications is restricted to systems programming personnel.","fixText":"Review the data set access authorizations defined to the ACP for the Base TCP/IP component. Configure these data sets to be protected in accordance with the following rules:\n\nWRITE and ALLOCATE access to product data sets is restricted to systems programming personnel (i.e., SMP/E distribution data sets with the prefix SYS1.TCPIP.AEZA and target data sets with the prefix SYS1.TCPIP. SEZA).\n\nWRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is restricted to systems programming personnel.\n\nNote: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same access authorization requirements.\n\nWRITE and ALLOCATE access to the data set(s) containing the Data and Profile configuration files is logged.\n\nNote: If any INCLUDE statements are specified in the Profile configuration file, the named MVS data sets have the same logging requirements.\n\nWRITE and ALLOCATE access to the data set(s) containing the configuration files shared by TCP/IP applications is restricted to systems programming personnel.","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223827","ruleId":"SV-223827r991589_rule","severity":"medium","ruleTitle":"IBM z/OS Configuration files for the TCP/IP stack must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Refer to the procedure libraries defined to JES2 and locate the TCPIP JCL member.\n\nNote:\nIf GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.\n\nIf GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.\n\nIf the PROFILE and SYSTCPD DD statements specify the TCP/IP Profile and Data configuration files respectively, this not a finding.\n\nIf the RESOLVER_CONFIG variable on the EXEC statement is set to the same file name specified on the SYSTCPD DD statement, this is not a finding.","fixText":"Review the TCP/IP started task JCL to ensure the configuration file names are specified on the appropriate DD statements and parameter option.\n\nDuring initialization the TCP/IP stack uses fixed search sequences to locate the PROFILE.TCPIP and TCPIP.DATA files. However, uncertainty is reduced and security auditing is enhanced by explicitly specifying the locations of the files. In the TCP/IP started task's JCL, Data Definition (DD) statements can be used to specify the locations of the files. The PROFILE DD statement identifies the PROFILE.TCPIP file and the SYSTCPD DD statement identifies the TCPIP.DATA file.\n\nThe location of the TCPIP.DATA file can also be specified by coding the RESOLVER_CONFIG environment variable as a parameter of the ENVAR option in the TCP/IP started task's JCL. In fact, the value of this variable is checked before the SYSTCPD DD statement by some processes. However, not all processes (e.g., TN3270 Telnet Server) will access the variable to get the file location. Therefore specifying the file location explicitly, both on a DD statement and through the RESOLVER_CONFIG environment variable, reduces ambiguity.\n\nNote:\nIf GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.\n\nIf GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.\n\nThe systems programmer responsible for supporting ICS will ensure that the TCP/IP started task's JCL specifies the PROFILE and SYSTCPD DD statements for the PROFILE.TCPIP and TCPIP.DATA configuration files and TCP/IP started task's JCL includes the RESOLVER_CONFIG variable, set to the name of the file specified on the SYSTCPD DD statement.","ccis":["CCI-000366"]},{"vulnId":"V-223831","ruleId":"SV-223831r958408_rule","severity":"medium","ruleTitle":"IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.","description":"During the SSL connection process a mutually acceptable encryption algorithm is selected by the server and client. This algorithm is used to encrypt the data that subsequently flows between the two. However, the level or strength of encryption can vary greatly. Certain configuration options can allow no encryption to be used and others can allow a relatively weak 40-bit algorithm to be used. Failure to properly enforce adequate encryption strength could result in the loss of data privacy.\n\nSatisfies: SRG-OS-000033-GPOS-00014, SRG-OS-000120-GPOS-00061, SRG-OS-000250-GPOS-00093, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, SRG-OS-000396-GPOS-00176, SRG-OS-000478-GPOS-00223, SRG-OS-000423-GPOS-00187, SRG-OS-000424-GPOS-00188, SRG-OS-000425-GPOS-00189, SRG-OS-000426-GPOS-00190, SRG-OS-000478-GPOS-00223","checkContent":"Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.\n\nIf the following items are in effect for the configuration specified in the TCP/IP Profile configuration file, this is not a finding.\n\nNOTE: If an INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nNOTE: FIPS 140-2 minimum encryption is the accepted level of encryption and will override this requirement if greater.\n\nThe TELNETGLOBALS block that specifies an ENCRYPTION statement states one or more of the below cipher specifications.\n\nEach TELNETPARMS block that specifies the SECUREPORT statement, specifies an ENCRYPTION statement states one or more of the below cipher specifications. And the TELNETGLOBALS block does or does not specify an ENCRYPTION statement.\n\nCipher Specifications\nSSL_3DES_SHA\nSSL_AES_256_SHA\nSSL_AES_128_SHA","fixText":"Configure the SECUREPORT and TELNETPARMS ENCRYPTION statements and/or the TELNETGLOBALS statement in the PROFILE.TCPIP file to conform to the requirements specified below.\n\nThe TELNETGLOBALS block may specify an ENCRYPTION statement that specifies one or more of the below cipher specifications.\n\nEach TELNETPARMS block that specifies the SECUREPORT statement, an ENCRYPTION statement is coded with one or more of the below cipher specifications. And the TELNETGLOBALS block does or does not specify an ENCRYPTION statement.\n\nTo prevent the use of non FIPS 140-2 encryption, the TELNETGLOBALS block and/or each TELNETPARMS block that specifies an ENCRYPTION statement will specify one or more of the following cipher specifications:\n\nCipher Specifications\nSSL_3DES_SHA\nSSL_AES_256_SHA\nSSL_AES_128_SHA\n\nNote: Always check for the minimum allowed in FIPS 140-2.","ccis":["CCI-000068","CCI-000803","CCI-001453","CCI-002418","CCI-002420","CCI-002421","CCI-002422","CCI-002450","CCI-002890","CCI-003123"]},{"vulnId":"V-223833","ruleId":"SV-223833r958586_rule","severity":"medium","ruleTitle":"The IBM z/OS warning banner for the TN3270 Telnet server must contain the proper content of the Standard Mandatory DoD Notice and Consent Banner.","description":"System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist.","checkContent":"Refer to the Profile configuration file specified on the PROFILE DD statement in the TN3270 started task JCL.\n\nIf all USS tables referenced in BEGINVTAM USSTCP statements include MSG10 text that specifies the Standard logon banner, this is not a finding. \n\nThe below banner is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. The thrust of this new policy is to make it clear that there is no expectation of privacy when using DoD information systems and all use of DoD information systems is subject to searching, auditing, inspecting, seizing, and monitoring, even if some personal use of a system is permitted:\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nDOD requires that a logon warning banner be displayed. Within the TN3270 Telnet Server, the banner can be implemented through the USS table that is specified on a BEGINVTAM USSTCP statement. The text associated with message ID 10 (i.e., MSG10) in the USS table is sent to clients that are subject to USSTCP processing.","fixText":"Review all USS tables referenced in BEGINVTAM USSTCP statements in the PROFILE.TCPIP file. Ensure the MSG10 text specifies a logon banner in accordance with DISA requirements. See required MSG10 content below:\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\n\nDOD requires that a logon warning banner be displayed. Within the TN3270 Telnet Server, the banner can be implemented through the USS table that is specified on a BEGINVTAM USSTCP statement. The text associated with message ID 10 (i.e., MSG10) in the USS table is sent to clients that are subject to USSTCP processing.","ccis":["CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388","CCI-000048","CCI-000050"]},{"vulnId":"V-223834","ruleId":"SV-223834r991589_rule","severity":"medium","ruleTitle":"IBM z/OS VTAM session setup controls for the TN3270 Telnet server must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Refer to the TN3270 Profile configuration file identified by the PROFILE DD in the TN3270 procedure.\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nIf all of the following are true, this is not a finding. \n\nIf any of the following is untrue, this is a finding.\n\n-Within each BEGINVTAM statement block, one BEGINVTAM USSTCP statement is coded that specifies only the table name operand. No client identifier, such as host name or IP address, is specified so the statement applies to all connections not otherwise controlled.\n-The USS table specified on each \"back stop\" USSTCP statement mentioned in Item (1) above is coded to allow access only to session manager applications and NC PASS applications.\n-Within each BEGINVTAM statement block, additional BEGINVTAM USSTCP statements that specify a USS table that allows access to other applications may be coded only if the statements include a client identifier operand that references only secure terminals.\n-Any BEGINVTAM DEFAULTAPPL statement that does not specify a client identifier, or specifies any type of client identifier that would apply to unsecured terminals, specifies a session manager application or an NC PASS application as the application name.\n-Any BEGINVTAM LUMAP statement, if used with the DEFAPPL operand and applied to unsecured terminals, specifies only a session manager application or an NC PASS application.\n\nNOTE: The BEGINVTAM LINEMODEAPPL requirements will not be reviewed at this time. Further testing must be performed to determine how the CL/Supersession and NC-PASS applications work with line mode.","fixText":"Review the BEGINVTAM configuration statements in the PROFILE.TCPIP file. Ensure they conform to the specifications below.\n\nNOTE: If the INCLUDE statement is coded in the TN3270 Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nWithin each BEGINVTAM statement block, one BEGINVTAM USSTCP statement is coded that specifies only the table name operand. No client identifier, such as host name or IP address, is specified so the statement applies to all connections not otherwise controlled.\n\nThe USS table specified on each \"back stop\" USSTCP statement mentioned above is coded to allow access only to session manager applications and NC PASS applications.\n\nWithin each BEGINVTAM statement block, additional BEGINVTAM USSTCP statements that specify a USS table that allows access to other applications may be coded only if the statements include a client identifier operand that references only secure terminals.\n\nAny BEGINVTAM DEFAULTAPPL statement that does not specify a client identifier, or specifies any type of client identifier that would apply to unsecured terminals, specifies a session manager application or an NC PASS application as the application name.","ccis":["CCI-000366"]},{"vulnId":"V-223835","ruleId":"SV-223835r970703_rule","severity":"medium","ruleTitle":"The IBM z/OS PROFILE.TCPIP configuration for the TN3270 Telnet server must have the INACTIVE statement properly specified.","description":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element.","checkContent":"Refer to the Profile configuration file specified on the PROFILE DD statement in the TN3270 started task JCL.\n\nNote: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nTELNETGLOBAL Block (only one defined)\n\nTELNETPARMS Block (one defined for each port the server is listening to, typically ports 23 and 992)\n\nIf the TELNETPARMS INACTIVE statement is coded either in the TELNETGLOBALS or within each TELNETPARMS statement block and specifies a value between \"1\" and \"900\", this is not a finding.","fixText":"Configure the configuration statements in the PROFILE.Tn3270 to conform to the specifications below:\n\nNOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well.\n\nThe TELNETPARMS INACTIVE statement is coded either within the TELNETGLOBALS OR within each TELNETPARMS statement block and specifies a value between \"1\" and \"900\".","ccis":["CCI-001133"]},{"vulnId":"V-223836","ruleId":"SV-223836r1137691_rule","severity":"medium","ruleTitle":"IBM Z/OS TSOAUTH resources must be restricted to authorized users.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRLIST SURROGAT * \n\nEnsure that all TSOAUTH resources and/or generic equivalent are properly protected according to the requirements specified. \n\nIf the following guidance is true, this is not a finding.\n\nThe ACCT authorization is restricted to security personnel.\n\nThe CONSOLE authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.) and READ access may be given to all user when SDSF in install at the ISSOs discretion.\n\nThe MOUNT authorization is restricted to DASD batch users only.\n\nThe OPER authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.).\n\nThe PARMLIB authorization is restricted to only z/OS systems programming personnel and READ access may be given to auditors.\n\nThe TESTAUTH authorization is restricted to only z/OS systems programming personnel.","fixText":"Configure the TSOAUTH resource class to control sensitive TSO/E commands.\n\n(Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nBelow is listed the access requirements for TSOAUTH resources. Ensure the guidelines for the resources and/or generic equivalent are followed.\n\nThe ACCT authorization is restricted to security personnel.\n\nThe CONSOLE authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.) and READ access may be given to all user when SDSF in install at the ISSOs discretion.\n\nThe MOUNT authorization is restricted to DASD batch users only.\n\nThe OPER authorization is restricted to authorized systems personnel (e.g., systems programming personnel, operations staff, etc.).\n\nThe PARMLIB authorization is restricted to only z/OS systems programming personnel and READ access may be given to audit users.\n\nThe TESTAUTH authorization is restricted to only z/OS systems programming personnel.","ccis":["CCI-000213"]},{"vulnId":"V-223837","ruleId":"SV-223837r958726_rule","severity":"high","ruleTitle":"IBM RACF LOGONIDs must not be defined to SYS1.UADS for non-emergency use.","description":"Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.","checkContent":"Ask the system administrator to provide a list of all emergency userids available to the site along with the associated function of each.\n\n If SYS1.UADS userids are limited and reserved for emergency purposes only, this is not a finding.","fixText":"Configure the SYS1.UADS entries to ensure LOGONIDs defined include only those users required to support specific functions related to system recovery. Evaluate the impact of accomplishing the change.","ccis":["CCI-002235"]},{"vulnId":"V-223838","ruleId":"SV-223838r1137691_rule","severity":"high","ruleTitle":"The IBM z/OS UNIX SUPERUSER resources must be protected in accordance with guidelines.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL UNIXPRIV * AUTHUSER\n\nIf the RACF rules for the SUPERUSER resource specify a default access of NONE, this is not a finding.\n\nIf there are no RACF rules that allow access to the SUPERUSER resource, this is not a finding.\n\nIf there is no RACF rule for CHOWN.UNRESTRICTED defined, this is not a finding.\n\nIf the RACF rules for each of the SUPERUSER resources listed in the z/OS UNIX System Services Planning, Establishing UNIX security, specify a default access of NONE, this is not a finding.\n\nIf the RACF rules for each of the SUPERUSER resources listed in the z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel, this is not a finding.","fixText":"Configure all SUPERUSER resources for the UNIXPRIV resource class to be restricted to appropriate system tasks and/or system programming personnel.\n\n-The RACF rules for the SUPERUSER resource specify a default access of NONE.\n-There are no RACF rules that allow access to the SUPERUSER resource.\n-There is no RACF rule for CHOWN.UNRESTRICTED defined.\n-The RACF rules for each of the SUPERUSER resources listed in the z/OS UNIX System Services Planning, Establishing UNIX security, specify a default access of NONE.\n-The RACF rules for each of the SUPERUSER resources listed in the z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel.\n\nSample Commands:\nRDEF UNIXPRIV SUPERUSER.** UACC(NONE) OWNER(ADMIN) DATA('REFERENCE ZUSS0023') AUDIT(ALL(READ))\n/* do not permit any users/groups to this resource */\n\nSR CLASS(UNIXPRIV) MASK(CHOWN.UNRESTRICTED)\n/* delete if found */\n\nPE SUPERUSER.FILESYS.** CL(UNIXPRIV) ID(<SYSPsmpl>)","ccis":["CCI-000213"]},{"vulnId":"V-223839","ruleId":"SV-223839r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS BPX resource(s) must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.","checkContent":"From the ISPF Command Shell enter:\nRL FACILITY * AUTHUSER\n\nIf the RACF rules for the BPX.** resource specify a default access of NONE, this is not a finding.\n\nIf there are no RACF user access to the BPX.** resource, this is not a finding.\n\nIf there is no RACF rule for BPX.SAFFASTPATH defined, this is not a finding.\n\nIf the RACF rules for each of the BPX resources listed in the z/OS UNIX System Services Planning, Establishing UNIX security, restrict access to appropriate system tasks or systems programming personnel, this is not a finding.","fixText":"There are a number of resources available under z/OS UNIX that must be secured in order to preserve system integrity while allowing effective application and user access. All of these resources might not be used in every configuration, but several of them have critical impacts.\n\nThe default access for each of these resources must be no access. A generic resource (e.g., BPX.**) must also be set to a default access of none to cover future additions. Because they convey especially powerful privileges, the settings for BPX.DAEMON, BPX.SAFFASTPATH, BPX.SERVER, and BPX.SUPERUSER require special attention.\n\nAccess to BPX.DAEMON must be restricted to the z/OS UNIX kernel userid, z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons (e.g., web servers).\n\nAs noted above, the BPX.SAFFASTPATH definition can cause successful security checks not to be audited. Because auditing of all accesses is required for some system files, BPX.SAFFASTPATH must not be used. \n\nAccess to BPX.SERVER must be restricted to system software processes that act as servers under z/OS UNIX (e.g., web servers).\n\nAccess to BPX.SUPERUSER must be restricted to Security Administrators and individual systems programming personnel. It is not appropriate for all systems programming personnel, only for those with responsibilities for components or products that use z/OS UNIX and that require superuser capability for maintenance.\n\n-The RACF rules for the BPX.** resource specify a default access of NONE.\n-There are no RACF user access to the BPX.** resource.\n-There is no RACF rule for BPX.SAFFASTPATH defined.\n-The RACF rules for each of the BPX resources specify a UACC value of NONE.\n-The RACF rules for each of the BPX resources restrict access to appropriate system tasks or systems programming personnel as specified.\n\nThe following list of sample commands is provided to implement this requirement:\n\nrdef facility bpx.** UACC(none) owner(admin) audit(all(read)) - data('see zuss0021') \nrdef facility bpx.daemon UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.daemon cl(facility id(<authorized_users>) \nrdef facility bpx.debug UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.debug cl(facility id(<authorized_users>) \nrdef facility bpx.fileattr.apf UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.fileattr.apf cl(facility id(<authorized_users>) \nrdef facility bpx.fileattr.progctl UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.fileattr.progctl cl(facility id(<authorized_users>) \nrdef facility bpx.jobname UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.jobname cl(facility id(<authorized_users>) \nrdef facility bpx.server UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.server cl(facility id(<authorized_users>) \nrdef facility bpx.smf UACC(none) owner(admin) - \naudit(all(read)) data('see zuss0021') \npe bpx.smf cl(facility id(<authorized_users>) \nrdef facility bpx.stor.swap UACC(none) owner(admin) -\naudit(all(read)) data('see zuss0021') \npe bpx.stor.swap cl(facility id(<authorized_users>) \nrdef facility bpx.superuser UACC(none) owner(admin) -\naudit(all(read)) data('see zuss0021') \npe bpx.superuser cl(facility id(<authorized_users>) \nrdef facility bpx.wlmserver UACC(none) owner(admin) -\naudit(all(read)) data('see zuss0021') \npe bpx.wlmserver cl(facility id(<authorized_users>)","ccis":["CCI-000213"]},{"vulnId":"V-223840","ruleId":"SV-223840r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX MVS HFS directories with other write permission bit set must be properly defined.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"On the OMVS Command line enter the following command string:\nfind / -type d -perm -0002 ! -perm -1000 -exec ls -aldWE {} \\;\n\nIf there are no directories that have the other write permission bit set on without the sticky bit set on, this is not a finding.\n\nNOTE: In the symbolic permission bit display, the sticky bit is indicated as a \"t\" or \"T\" in the execute portion of the other permissions. For example, a display of the permissions of a directory with the sticky bit on could be \"drwxrwxrwt\".\n\nIf all directories that have the other write permission bit set on do not contain any files with the setuid bit set on, this is not a finding.\n\nNOTE: In the symbolic permission bit display, the setuid bit is indicated as an \"s\" or \"S\" in the execute portion of the owner permissions. For example, a display of the permissions of a file with the setuid bit on could be \"-rwsrwxrwx\".\n\nIf all directories that have the other write permission bit set on do not contain any files with the setgid bit set on, this is not a finding.\n\nNOTE: In the symbolic permission bit display, the setgid bit is indicated as an \"s\" or \"S\" in the execute portion of the group permissions. For example, a display of the permissions of a file with the setgid bit on could be \"-rwxrwsrwx\".","fixText":"Configure directory permissions as follows:\nThere are no directories that have the other write permission bit set on without the sticky bit set on.\nNOTE: In the symbolic permission bit display, the sticky bit is indicated as a \"t\" or \"T\" in the execute portion of the other permissions. For example, a display of the permissions of a directory with the sticky bit on could be \"drwxrwxrwt\".\n\nAll directories that have the other write permission bit set on do not contain any files with the setuid bit set on.\nNOTE: In the symbolic permission bit display, the setuid bit is indicated as an \"s\" or \"S\" in the execute portion of the owner permissions. For example, a display of the permissions of a file with the setuid bit on could be \"-rwsrwxrwx\".\n\nAll directories that have the other write permission bit set on do not contain any files with the setgid bit set on.\nNOTE: In the symbolic permission bit display, the setgid bit is indicated as an \"s\" or \"S\" in the execute portion of the group permissions. For example, a display of the permissions of a file with the setgid bit on could be \"-rwxrwsrwx\".","ccis":["CCI-000213"]},{"vulnId":"V-223842","ruleId":"SV-223842r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX security parameters in etc/profile must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nISHELL\n/etc/profile\n\nIf the final or only instance of the UMASK command in /etc/profile is specified as \"umask 077\", this is not a finding.\n\nIf the LOGNAME variable is marked read-only (i.e., \"readonly LOGNAME\") in /etc/profile, this is not a finding.","fixText":"Configure the etc/profile to specify the UMASK command is executed with a value of 077, the LOGNAME variable is marked read-only for the /etc/profile file, and exceptions are documented with the ISSO.","ccis":["CCI-000213"]},{"vulnId":"V-223843","ruleId":"SV-223843r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX security parameters in /etc/rc must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"From the ISPF Command Shell enter:\nISHELL\n/etc/rc\n\nIf all of the CHMOD commands in /etc/rc do not result in less restrictive access than what is specified in the tables below, this is not a finding.\n\nNOTE: The use of CHMOD commands in /etc/rc is required in most environments to comply with the required settings, especially for dynamic objects such as the /dev directory.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nIf all of the CHAUDIT commands in /etc/rc do not result in less auditing than what is specified in the tables below, this is not a finding.\n\nNOTE: The use of CHAUDIT commands in /etc/rc may not be necessary. If none are found, there is not a finding.\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nIf the _BPX_JOBNAME variable is appropriately set (i.e., to match daemon name) as each daemon (e.g., syslogd, inetd) is started in /etc/rc, this is not a finding.\n\nNOTE: If _BPX_JOBNAME is not specified, the started address space will be named using an inherited value. This could result in reduced security in terms of operator command access.\n\nSYSTEM DIRECTORY SECURITY SETTINGS\nDIRECTORY PERMISSION BITS USER AUDIT BITS FUNCTION\n/ [root] 755 faf Root level of all file systems. Holds critical mount points.\n/bin 1755 fff Shell scripts and executables for basic functions\n/dev 1755 fff Character-special files used when logging into the OMVS shell and during C language program compilation.\n Files are created during system IPL and on a per-demand basis.\n/etc 1755 faf Configuration programs and files (usually with locally customized data) used by z/OS UNIX and other product initialization processes\n/lib 1755 fff System libraries including dynamic link libraries and files for static linking\n/samples 1755 fff Sample configuration and other files\n/tmp 1777 fff Temporary data used by daemons, servers, and users. Note: /tmp must have the sticky bit on to restrict file renames and deletions.\n/u 1755 fff Mount point for user home directories and optionally for third-party software and other local site files\n/usr 1755 fff Shell scripts, executables, help (man) files and other data. Contains sub-directories (e.g., lpp) and mount points used by program products that may be in separate file systems.\n/var 1775 fff Dynamic data used internally by products and by elements and features of z/OS UNIX.\n\nSYSTEM FILE SECURITY SETTINGS\nFILE PERMISSION BITS USER AUDIT BITS FUNCTION\n/bin/sh 1755 faf z/OS UNIX shell\n Note: /bin/sh has the sticky bit on to improve performance.\n/dev/console 740 fff The system console file receives messages that may require System Administrator (SA) attention.\n/dev/null 666 fff A null file; data written to it is discarded.\n/etc/auto.master and\nany mapname files 740 faf Configuration files for automount facility\n/etc/inetd.conf 740 faf Configuration file for network services\n/etc/init.options 740 faf Kernel initialization options file for z/OS UNIX environment\n/etc/log 744 fff Kernel initialization output file\n/etc/profile 755 faf Environment setup script executed for each user\n/etc/rc 744 faf Kernel initialization script for z/OS UNIX environment\n/etc/steplib 740 faf List of MVS data sets valid for set user ID and set group ID executables\n/etc/tablename 740 faf List of z/OS userids and group names with corresponding alias names\n/usr/lib/cron/at.allow\n/usr/lib/cron/at.deny 700 faf Configuration files for the at and batch commands\n/usr/lib/cron/cron.allow\n/usr/lib/cron/cron.deny 700 faf Configuration files for the crontab command","fixText":"Review the settings in the /etc/rc. The /etc/rcfile is the system initialization shell script. When z/OS UNIX kernel services start, /etc/rc is executed to set file permissions and ownership for dynamic system files and to perform other system startup functions such as starting daemons. There can be many commands in /etc/rc. There are two specific guidelines that must be followed:\n\nVerify that the CHMOD or CHAUDIT command does not result in less restrictive security than what is specified in the table below.\nImmediately prior to each command that starts a daemon, the _BPX_JOBNAME variable must be set to match the daemon's name (e.g., inetd, syslogd). The use of _BPX_USERID is at the site's discretion, but is recommended.\n\nDirectory Permission Bits User Audit Bits Function\n/ [root] 755 faf Root level of all file systems. Holds critical mount points.\n/bin 1755 fff Shell scripts and executables for basic functions\n/dev 1755 fff Character-special files used when logging into the OMVS shell and during C language program compilation. Files are created during system IPL and on a per-demand basis.\n/etc 1755 faf Configuration programs and files (usually with locally customized data) used by z/OS UNIX and other product initialization processes\n/lib 1755 fff System libraries including dynamic link libraries and files for static linking\n/samples 1755 fff Sample configuration and other files\n/tmp 1777 fff Temporary data used by daemons, servers, and users. Note: /tmp must have the sticky bit on to restrict file renames and deletions.\n/u 1755 fff Mount point for user home directories and optionally for third-party software and other local site files\n/usr 1755 fff Shell scripts, executables, help (man) files and other data. Contains sub-directories (e.g., lpp) and mount points used by program products that may be in separate file systems.\n/var 1775 fff Dynamic data used internally by products and by elements and features of z/OS UNIX.","ccis":["CCI-000213"]},{"vulnId":"V-223844","ruleId":"SV-223844r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000326-GPOS-00126","checkContent":"From the ISPF Command Shell enter:\nRL SURROGAT BPX.SRV AUTHUSER \n\nIf the RACF rules for all BPX.SRV.user SURROGAT resources specify a default access of NONE, this is not a finding.\n\nIf the RACF rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX, this is not a finding.\n\nIf the RACF rules for all BPX.SRV.user SURROGAT resources restrict access to authorized users identified in the Site Security Plan, this is not a finding.","fixText":"SURROGAT class BPX resources are used in conjunction with server applications that are performing tasks on behalf of client users that may not supply an authenticator to the server. This can be the case when clients are otherwise validated or when the requested service is performed from userids representing groups.\n\nConfigure the default access for each BPX.SRV.userid resource must be no access. Access can be permitted only to system software processes that act as servers under z/OS UNIX (e.g., web servers) and users whose access and approval are identified in the Site Security Plan.\n\nA sample is provided here:\n\nRDEF SURROGAT BPX.SRV.user UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ))\n\n-RACF rules for all BPX.SRV.user SURROGAT resources must restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX.\n\nRDEF SURROGAT BPX.SRV.user UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ))\nPE BPX.SRV.user CL(SURROGAT) ID(<server>)","ccis":["CCI-000213","CCI-002233"]},{"vulnId":"V-223845","ruleId":"SV-223845r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX MVS data sets or HFS objects must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"Refer to the proper BPXPRMxx member in SYS1.PARMLIB \n\nIf the ESM data set rules for the data sets referenced in the ROOT and the MOUNT statements in BPXPRMxx restrict update access to the z/OS UNIX kernel (i.e., OMVS or OMVSKERN), this is not a finding.\n\nIf the ESM data set rules for the data set referenced in the ROOT and the MOUNT statements in BPXPRMxx restrict update and/or allocate access to systems programming personnel, this is not a finding.","fixText":"Review the access authorizations defined in the ACP for the MVS data sets that contain operating system components and for the MVS data sets that contain HFS file systems and ensure that they conform to the specifications below Review the UNIX permission bits on the HFS directories and files and ensure that they conform to the specifications below:\n\nDefine ESM data set rules for the data sets referenced in the ROOT and the MOUNT statements in BPXPRMxx to restrict update access to the z/OS UNIX kernel (i.e., OMVS or OMVSKERN).\n\nDefine ESM data set rules for the data set referenced in the ROOT and the MOUNT statements in BPXPRMxx to restrict update and/or allocate access to systems programming personnel.","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223846","ruleId":"SV-223846r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX MVS data sets WITH z/OS UNIX COMPONENTS must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"Execute an access list for MVS DATA SETS WITH z/OS UNIX COMPONENTS.\n\nIf the ESM data set rules for each of the data sets listed in the table below restrict UPDATE and ALLOCATE access to systems programming personnel, this is not a finding.\n\nMVS DATA SETS WITH z/OS UNIX COMPONENTS\nDATA SET NAME/MASK MAINTENANCE TYPE FUNCTION\nSYS1.ABPX* Distribution IBM z/OS UNIX ISPF panels, messages, tables, clists\nSYS1.AFOM* Distribution IBM z/OS UNIX Application Services\nSYS1.BPA.ABPA* Distribution IBM z/OS UNIX Connection Scaling Process Mgr.\nSYS1.CMX.ACMX* Distribution IBM z/OS UNIX Connection Scaling Connection Mgr.\nSYS1.SBPX* Target IBM z/OS UNIX ISPF panels, messages, tables, clists\nSYS1.SFOM* Target IBM z/OS UNIX Application Services\nSYS1.CMX.SCMX* Target IBM z/OS UNIX Connection Scaling Connection Mgr.","fixText":"Define ESM data set rules for each of the data sets listed in the table below restrict UPDATE and ALLOCATE access to systems programming personnel.\n\nThe data sets designated as distribution data sets should have all access restricted to systems programming personnel. TSO/E users who also use z/OS UNIX should have read access to the SYS1.SBPX* data sets. Read access for all users to the remaining target data sets is at the site's discretion. All other access must be restricted to systems programming personnel.\n\nMVS DATA SETS WITH z/OS UNIX COMPONENTS\nDATA SET NAME/MASK MAINTENANCE TYPE FUNCTION\nSYS1.ABPX* Distribution IBM z/OS UNIX ISPF panels, messages, tables, clists\nSYS1.AFOM* Distribution IBM z/OS UNIX Application Services\nSYS1.BPA.ABPA* Distribution IBM z/OS UNIX Connection Scaling Process Mgr.\nSYS1.CMX.ACMX* Distribution IBM z/OS UNIX Connection Scaling Connection Mgr.\nSYS1.SBPX* Target IBM z/OS UNIX ISPF panels, messages, tables, clists\nSYS1.SFOM* Target IBM z/OS UNIX Application Services\nSYS1.CMX.SCMX* Target IBM z/OS UNIX Connection Scaling Connection Mgr.","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223847","ruleId":"SV-223847r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX HFS permission bits and audit bits for each directory must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"From the ISPF Command Shell enter:\nomvs\nenter CD / \nenter ls -alW\n\nIf the HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the SYSTEM DIRECTORY SECURITY SETTINGS table below, this is not a finding.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\n SYSTEM DIRECTORY SECURITY SETTINGS\nDIRECTORY PERMISSION BITS USER AUDIT BITS FUNCTION\n/ [root] 755 faf Root level of all file systems. Holds critical mount points.\n/bin 1755 fff Shell scripts and executables for basic functions\n/dev 1755 fff Character-special files used when logging into the OMVS shell and during C language program compilation.\n Files are created during system IPL and on a per-demand basis.\n/etc 1755 faf Configuration programs and files (usually with locally customized data) used by z/OS UNIX and other product initialization processes\n/lib 1755 fff System libraries including dynamic link libraries and files for static linking\n/samples 1755 fff Sample configuration and other files\n/tmp 1777 fff Temporary data used by daemons, servers, and users. Note: /tmp must have the sticky bit on to restrict file renames and deletions.\n/u 1755 fff Mount point for user home directories and optionally for third-party software and other local site files\n/usr 1755 fff Shell scripts, executables, help (man) files and other data. Contains sub-directories (e.g., lpp) and mount points used by program products that may be in separate file systems.\n/var 1775 fff Dynamic data used internally by products and by elements and features of z/OS UNIX.","fixText":"Configure the UNIX permission bits and user audit bits on each of the HFS directories in the table SYSTEM DIRECTORY SECURITY SETTINGS below to be equal or more restrictive.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\n SYSTEM DIRECTORY SECURITY SETTINGS\nDIRECTORY PERMISSION BITS USER AUDIT BITS FUNCTION\n/ [root] 755 faf Root level of all file systems. Holds critical mount points.\n/bin 1755 fff Shell scripts and executables for basic functions\n/dev 1755 fff Character-special files used when logging into the OMVS shell and during C language program compilation.\n Files are created during system IPL and on a per-demand basis.\n/etc 1755 faf Configuration programs and files (usually with locally customized data) used by z/OS UNIX and other product initialization processes\n/lib 1755 fff System libraries including dynamic link libraries and files for static linking\n/samples 1755 fff Sample configuration and other files\n/tmp 1777 fff Temporary data used by daemons, servers, and users. Note: /tmp must have the sticky bit on to restrict file renames and deletions.\n/u 1755 fff Mount point for user home directories and optionally for third-party software and other local site files\n/usr 1755 fff Shell scripts, executables, help (man) files and other data. Contains sub-directories (e.g., lpp) and mount points used by program products that may be in separate file systems.\n/var 1775 fff Dynamic data used internally by products and by elements and features of z/OS UNIX.\n\nThe following commands are a sample of the commands to be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 0755 /\nchaudit w=sf,rx+f /\nchmod 0755 /bin\nchaudit rwx=f /bin","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223848","ruleId":"SV-223848r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX SYSTEM FILE SECURITY SETTINGS must be properly protected or specified.","description":"If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"From the ISPF Command Shell enter:\nOMVS\n\nFor each file listed in the table below enter:\nls -alW /<directory name>/<file name>\n\nIf the HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table, this is not a finding.\n\nNOTE: Some of the files listed are not used in every configuration. Absence of any of the files is not considered a finding.\n\nSYSTEM FILE SECURITY SETTINGS\nFILE PERMISSION BITS USER AUDIT BITS FUNCTION\n/bin/sh 1755 faf z/OS UNIX shell\n Note: /bin/sh has the sticky bit on to improve performance.\n/dev/console 740 fff The system console file receives messages that may require System Administrator (SA) attention.\n/dev/null 666 fff A null file; data written to it is discarded.\n/etc/auto.master\nany mapname files 740 faf Configuration files for automount facility\n/etc/inetd.conf 740 faf Configuration file for network services\n/etc/init.options 740 faf Kernel initialization options file for z/OS UNIX environment\n/etc/log 744 fff Kernel initialization output file\n/etc/profile 755 faf Environment setup script executed for each user\n/etc/rc 744 faf Kernel initialization script for z/OS UNIX environment\n/etc/steplib 740 faf List of MVS data sets valid for set user ID and set group ID executables\n/etc/tablename 740 faf List of z/OS userids and group names with corresponding alias names\n/usr/lib/cron/at.allow\n/usr/lib/cron/at.deny 700 faf Configuration files for the at and batch commands\n/usr/lib/cron/cron.allow\n/usr/lib/cron/cron.deny 700 faf Configuration files for the crontab command\n\nNOTE: Some of the files listed are not used in every configuration. Absence of any of the files is not considered a finding.\n\nNOTE: The names of the MapName files are site-defined. Refer to the listing in the EAUTOM report.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"Define the UNIX permission bits and user audit bits on the HFS files as listed in the table below.\n\nSYSTEM FILE SECURITY SETTINGS\nFILE PERMISSION BITS USER AUDIT BITS FUNCTION\n/bin/sh 1755 faf z/OS UNIX shell\n Note: /bin/sh has the sticky bit on to improve performance.\n/dev/console 740 fff The system console file receives messages that may require System Administrator (SA) attention.\n/dev/null 666 fff A null file; data written to it is discarded.\n/etc/auto.master\nany mapname files 740 faf Configuration files for automount facility\n/etc/inetd.conf 740 faf Configuration file for network services\n/etc/init.options 740 faf Kernel initialization options file for z/OS UNIX environment\n/etc/log 744 fff Kernel initialization output file\n/etc/profile 755 faf Environment setup script executed for each user\n/etc/rc 744 faf Kernel initialization script for z/OS UNIX environment\n/etc/steplib 740 faf List of MVS data sets valid for set user ID and set group ID executables\n/etc/tablename 740 faf List of z/OS userids and group names with corresponding alias names\n/usr/lib/cron/at.allow\n/usr/lib/cron/at.deny 700 faf Configuration files for the at and batch commands\n/usr/lib/cron/cron.allow\n/usr/lib/cron/cron.deny 700 faf Configuration files for the crontab command\n\nThere are a number of files that must be secured to protect system functions in z/OS UNIX. Where not otherwise specified, these files must receive a permission setting of 744 or 774. The 774 setting may be used at the site's discretion to help to reduce the need for assignment of superuser privileges. The table identifies permission bit and audit bit settings that are required for these specific files. More restrictive permission settings may be used at the site's discretion or as specific environments dictate.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nThe following commands are a sample of the commands to be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 1755 /bin/sh\nchaudit w=sf,rx+f /bin/sh\nchmod 0740 /dev/console\nchaudit rwx=f /dev/console","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223849","ruleId":"SV-223849r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX MVS data sets used as step libraries in /etc/steplib must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"Refer to the pathname from the STEPLIBLIST line in BPXPRMxx member of PARMLIB.\n\nFrom the ISPF Command Shell enter:\nISHELL\n\nOn the command line:\non the path name line enter:\n/etc/ \n\nFrom the resulting display scroll down to the <stepliblist name> from BPXPRMxx parm.\nEnter B for browse on that line.\n\nIf ESM data set rules for libraries specified restrict WRITE or greater access to only systems programming personnel, this is not a finding.\n\nIf the ESM data set rules for libraries specify that all (i.e., failures and successes) WRITE or greater access will be logged, this is not a finding.","fixText":"Configure WRITE or greater access to libraries residing in the /etc/steplib to be limited to system programmers only.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-223850","ruleId":"SV-223850r958730_rule","severity":"medium","ruleTitle":"The IBM RACF classes required to properly secure the z/OS UNIX environment must be ACTIVE.","description":"In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations.","checkContent":"From the ISPF Command Shell enter:\nSETRopts list\n\nIf the ACTIVE CLASSES list includes entries for the FACILITY, SURROGAT, and UNIXPRIV resource classes, this is not a finding.\n\nIf either of the above resource classes is missing, this is a finding.","fixText":"Define the ACTIVE CLASS Parameter in SETROPTS to include the FACILITY, SURROGAT and UNIXPRIV resource classes.\n\nEXAMPLES:\nSETR CLASSACT(FACILITY SURROGAT UNIXPRIV) \n\nSETR GENERIC(FACILITY SURROGAT UNIXPRIV)\nSETR GENCMD(FACILITY SURROGAT UNIXPRIV)\n\nSETR RACL(FACILITY SURROGAT UNIXPRIV)","ccis":["CCI-002233"]},{"vulnId":"V-223851","ruleId":"SV-223851r991589_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX OMVS parameters in PARMLIB must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Refer to the IEASYS00 member of SYS1.PARMLIB.\n\nIf the parameter is specified as OMVS=xx or OMVS=(xx,xx,...) in the IEASYSxx member, this is not a finding.\n\nIf the OMVS statement is not specified, OMVS=DEFAULT is used. In minimum mode there is no access to permanent file systems or to the shell, and IBM's Communication Server TCP/IP will not run.","fixText":"Configure the settings in PARMLIB and /etc for z/OS UNIX security parameters with values that conform to the specifications below:\n\nThe parameter is specified as OMVS=xx or OMVS=(xx,xx,...) in the IEASYSxx member.\n\nNote: If the OMVS statement is not specified, OMVS=DEFAULT is used. In minimum mode there is no access to permanent file systems or to the shell, and IBM's Communication Server TCP/IP will not run.","ccis":["CCI-000366"]},{"vulnId":"V-223852","ruleId":"SV-223852r991589_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX BPXPRMxx security parameters in PARMLIB must be properly specified.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Refer to the BPXPRM00 member of SYS1.PARMLIB.\n\nIf the required parameter keywords and values are defined as detailed below, this is not a finding.\n\nParameter Keyword Value\nSUPERUSER BPXROOT\nTTYGROUP TTY\nSTEPLIBLIST /etc/steplib\nUSERIDALIASTABLE Will not be specified.\nROOT SETUID will be specified\nMOUNT NOSETUID\nSETUID (for Vendor-provided files)SECURITY\nSTARTUP_PROC OMVS","fixText":"Define the settings in PARMLIB member BPXPRMxx for z/OS UNIX security parameters values to conform to the specifications below:\nParameter Keyword Value\nSUPERUSER BPXROOT\nTTYGROUP TTY\nSTEPLIBLIST /etc/steplib\nUSERIDALIASTABLE Will not be specified.\nROOT SETUID will be specified\nMOUNT NOSETUIDSETUID (for Vendor-provided files)SECURITY\nSTARTUP_PROC OMVS","ccis":["CCI-000366"]},{"vulnId":"V-223853","ruleId":"SV-223853r991589_rule","severity":"medium","ruleTitle":"IBM z/OS default profiles must be defined in the corresponding FACILITY Class Profile for classified systems.","description":"Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.\n\nConfiguration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"If the system is not classified, this is Not Applicable.\n\nFrom a command input screen enter:\n\nRLIST FACILITY (BPX.UNIQUE.USER) ALL\nExamine APPLICATION DATA for userid\n\nIf system is classified and a userid is are not defined in the Application Data field in the BPX.UNIQUE.USER resource in the FACILITY report, this is not a finding.","fixText":"If system is classified a userid should not be defined in the application data field of the FACILITY report.\n\nThe sample commands below show the required security parameters required for the default user:\n\nAU OEDFLTU DFLTGRP(OEDFLTG) NAME('OE DEFAULT USER') NOPASS -\nOMVS(UID(99999) HOME('/u/oeflt') PROGRAM('/bin/echo')) - \nDATA('DEFAULT OMVSUSERID ADDED WITH SOER5') \n\nRDEF FACILITY BPX. UNIQUE.USER APPLDATA() - \nDATA('ADDED TO SUPPORT THE DEFAULT USER') UACC(NONE) OWNER(ADMIN) \n\nSETR RACLIST(FACILITY) REFRESH","ccis":["CCI-000366"]},{"vulnId":"V-223854","ruleId":"SV-223854r991589_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX HFS MapName files security parameters must be properly specified.","description":"Removal of unneeded or non-secure functions, ports, protocols, and services mitigate the risk of unauthorized connection of devices, unauthorized transfer of information, or other exploitation of these resources.\n\nThe organization must perform a periodic scan/review of the application (as required by CCI-000384) and disable functions, ports, protocols, and services deemed to be unneeded or non-secure.","checkContent":"Refer to the logical parmlib data sets, example: SYS1.PARMLIB(BPXPRMxx), for the following FILESYSTYPE entry:\n\nFILESYSTYPE TYPE(AUTOMNT) ENTRYPOINT(BPXTAMD)\n\nIf the above entry is not found or is commented out in the BPXPRMxx member(s), this is Not Applicable.\n\nFrom the ISPF Command Shell enter:\nOMVS\ncd /etc\ncat auto.master\nperform a contents list for the file identified \nExample:\ncat u.map\nNote: The /etc/auto.master HFS file (and the use of Automount) is optional. If the file does not exist, this is not applicable.\n\nNote: The setuid parameter and the security parameter have a significant security impact. For this reason these parameters must be explicitly specified and not allowed to default.\n\nIf each MapName file specifies the \"setuid No\" and \"security Yes\" statements for each automounted directory, this is not a finding.\n\nIf there is any deviation from the required values, this is a finding.","fixText":"Review the settings in /etc/auto.master and /etc/mapname for z/OS UNIX security parameters and configure the values to conform to the specifications below.\n\nThe /etc/auto.master HFS file (and the use of Automount) is optional. \n\nThe setuid parameter and the security parameter have a significant security impact. For this reason these parameters must be explicitly specified and not be allowed to default.\n\nEach MapName file will specify the \"setuid NO\" and \"security YES statements for each automounted directory.\n\nIf there is a deviation from the required values, documentation must exist for the deviation.\n\nSecurity NO disables security checking for file access. Security NO is only allowed on test and development domains.\n\nSetuid YES allows a user to run under a different UID/GID identity. Justification documentation is required to validate the use of setuid YES.","ccis":["CCI-000366"]},{"vulnId":"V-223855","ruleId":"SV-223855r1195300_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf must be properly specified.","description":"In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.\n\nOperating systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., VPN and IPS); however, doing so increases risk over limiting the services provided by any one component.\n\nTo support the requirements and principles of least functionality, the operating system must support the organizational requirements, providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved to conduct official business or to address authorized quality of life issues.","checkContent":"From the UNIX System Services ISPF Shell, enter:\n\n/etc/inetd.conf\n\nIf any Restricted Network Services that are listed below are specified or specified but not commented out, this is a finding.\n\nRESTRICTED NETWORK SERVICES/PORTS\nService Port\nChargen 19\nDaytime 13\nDiscard 9\nEcho 7\nExec 512\nfinger 79\nshell 514\ntime 37\nlogin 513\nsmtp 25\ntimed 525\nnameserver 42\nsystat 11\nuucp 540\nnetstat 15\ntalk 517\nqotd 17","fixText":"Review the settings in the /etc/inetd.conf file determine if every entry in the file represents a service in use. Services that are not in use must be disabled to reduce potential security exposures.\n\nThe following services must be disabled in /etc/inetd.conf unless justified and documented with the information system security officer (ISSO):\n\nRESTRICTED NETWORK SERVICES\n\nService Port\nChargen 19\nDaytime 13\nDiscard 9\nEcho 7\nExec 512\nfinger 79\nshell 514\ntime 37\nlogin 513\nsmtp 25\ntimed 525\nnameserver 42\nsystat 11\nuucp 540\nnetstat 15\ntalk 517\nqotd 17\n\nThe /etc/inetd.conf file is used by the INETD daemon. It specifies how INETD is to handle service requests on network sockets. Specifically, there is one entry in inetd.conf for each service. Each service entry specifies several parameters. The login_name parameter is of special interest. It specifies the userid under which the forked daemon is to execute. This userid is defined to the ACP and it may require a UID(0) (i.e., superuser authority) value.","ccis":["CCI-000382"]},{"vulnId":"V-223856","ruleId":"SV-223856r958482_rule","severity":"high","ruleTitle":"IBM z/OS UID(0) must be properly assigned.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"From a z/OS command screen enter:\nSR CLASS(USER) UID(0) \n\n If UID(0) is assigned only to system tasks such as the z/OS/ UNIX kernel (i.e., OMVS), z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons, this is not a finding.\n\n If UID(0) is assigned to security administrators who create or maintain user account definitions; and to systems programming accounts dedicated to maintenance (e.g., SMP/E) of HFS-based components, this not a finding.\n\nNOTE: The assignment of UID(0) confers full time superuser privileges. This is not appropriate for personal user accounts. Access to the BPX.SUPERUSER resource is used to allow personal user accounts to gain short-term access to superuser privileges.\n\n If UID(0) is assigned to non-systems or non-maintenance accounts, this is a finding.","fixText":"Assign UID(0) as specified below:\nUID(0) is assigned only to system tasks such as the z/OS UNIX kernel (i.e., OMVS), z/OS UNIX daemons (e.g., inetd, syslogd, ftpd), and other system software daemons.\n\nUID(0) is assigned to security administrators who create or maintain user account definitions; and to systems programming accounts dedicated to maintenance (e.g., SMP/E) of HFS-based components.\n\nNOTE: The assignment of UID(0) confers full time superuser privileges, this is not appropriate for personal user accounts. Access to the BPX.SUPERUSER resource is used to allow personal user accounts to gain short-term access to superuser privileges.","ccis":["CCI-000764"]},{"vulnId":"V-223857","ruleId":"SV-223857r958482_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX groups must be defined with a unique GID.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. RACF userid groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.","checkContent":"From ISPF Command Shell enter:\nListgrp * OMVS\n\nIf each group is defined with a unique GID, this is not a finding.\n\nNote: A site can choose to have both an OMVSGRP group and an STCOMVS group or combine the groups under one of these names.\n\nIf OMVSGRP and/or STCOMVS groups are defined and have a unique GID in the range of 1-99, this is not a finding.","fixText":"Define each UNIX group with a unique GID.\n\nDefine the OMVSGRP group and/or the STCOMVS group to the security database with a unique GID in the range of 1-99.\n\nOMVSGRP is the name suggested by IBM for all the required userids. STCOMVS is the standard name used at some sites for the userids that are associated with z/OS UNIX started tasks and daemons. These groups can be combined at the site's discretion.","ccis":["CCI-000764"]},{"vulnId":"V-223859","ruleId":"SV-223859r958482_rule","severity":"medium","ruleTitle":"The IBM z/OS user account for the UNIX kernel (OMVS) must be properly defined to the security database.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.","checkContent":"If OMVS userid is defined to the ESM as follows, this is not a finding.\n\nNo access to interactive on-line facilities (e.g., TSO, CICS, etc.)\nDefault group specified as OMVSGRP or STCOMVS\nUID(0)\nHOME directory specified as \"/\"\nShell program specified as \"/bin/sh\"","fixText":"Define OMVS userid to the ESM as specified below:\n\nNo access to interactive on-line facilities (e.g., TSO, CICS, etc.)\nDefault group specified as OMVSGRP or STCOMVS\nUID(0)\nHOME directory specified as \"/\"\nShell program specified as \"/bin/sh\"","ccis":["CCI-000764"]},{"vulnId":"V-223860","ruleId":"SV-223860r958482_rule","severity":"medium","ruleTitle":"The IBM z/OS user account for the z/OS UNIX SUPERUSER userid must be properly defined.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"Refer to system PARMLIB member BPXPRMxx (xx is determined by OMVS entry in IEASYS00.) \n\nDetermine the user ID identified by the SUPERUSER parameter. (BPXROOT is the default).\n\nFrom a command input screen enter:\nLISTUSER (superuser userid) TSO CICS OMVS\n\nIf the SUPERUSER userid is defined as follows, this is not a finding:\n\n-No access to interactive on-line facilities (e.g., TSO, CICS, etc.)\n-Default group specified as OMVSGRP or STCOMVS\n-UID(0)\n-HOME directory specified as \"/\"\n-Shell program specified as \"/bin/sh\"","fixText":"Define the user ID identified in the BPXPRM00 SUPERUSER parameter as specified below:\n\n-No access to interactive on-line facilities (e.g., TSO, CICS, etc.)\n-Default group specified as OMVSGRP or STCOMVS\n-UID(0)\n-HOME directory specified as \"/\"\n-Shell program specified as \"/bin/sh\"","ccis":["CCI-000764"]},{"vulnId":"V-223861","ruleId":"SV-223861r958482_rule","severity":"medium","ruleTitle":"The IBM z/OS user account for the UNIX (RMFGAT) must be properly defined.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"RMFGAT is the userid for the Resource Measurement Facility (RMF) Monitor III Gatherer. \n\nIf RMFGAT is not defined, this is Not Applicable.\n\nFrom a command input screen enter:\nLISTUSER (RMFGAT) OMVS\n\nIf RMFGAT is defined as follows, this is not a finding.\n\nDefault group specified as OMVSGRP or STCOMVS\nA unique, non-zero UID\nHOME directory specified as \"/\"\nShell program specified as \"/bin/sh\"","fixText":"Define the RMFGAT user account as specified below:\n\nDefault group specified as OMVSGRP or STCOMVS\nA unique, non-zero UID\nHOME directory specified as \"/\"\nShell program specified as \"/bin/sh\"","ccis":["CCI-000764"]},{"vulnId":"V-223862","ruleId":"SV-223862r958482_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX user accounts must be properly defined.","description":"To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"From a z/OS command screen enter:\nLISTUSER * OMVS NORACF\n\nNOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).\n\nIf each user account with an OMVS segment is defined as follows, this is not a finding.\n\n-A unique UID number (except for UID(0) users).\n-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).\n-Shell program specified as \"/bin/sh\", \"/bin/tcsh\", \"/bin/echo\", or \"/bin/false\".\n\nNOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).","fixText":"Define users of z/OS UNIX (i.e., users with an OMVS profile defined) as follows:\n\n-A unique UID number (except for UID(0) users).\n-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).\n-Shell program specified as \"/bin/sh\", \"/bin/tcsh\", \"/bin/echo\", or \"/bin/false\".\n\nNOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).","ccis":["CCI-000764"]},{"vulnId":"V-223863","ruleId":"SV-223863r958482_rule","severity":"medium","ruleTitle":"IBM z/OS attributes of UNIX user accounts used for account modeling must be defined in accordance with security requirements.","description":"To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"If this is a Classified system, and there is an account used for modeling, this is a finding.\n\nFrom a command input screen enter:\nRLIST FACILITY (BPX.UNIQUE.USER) ALL\nExamine APPLICATION DATA for userid\n\nEnter:\nList User (<userid>)\n\nNote: This check applies to any user id used to model OMVS access on the mainframe. This includes the OMVS default user and BPX.UNIQUE.USER. If the OMVS default user or BPX.UNIQUE.USER is not defined in the FACILITY report, this is Not Applicable.\n\nIf user account used for OMVS account modeling is defined as follows, this is not a finding:\n\nA non-writable HOME directory:\nShell program specified as \"/bin/echo\" or \"/bin/false\"\n\nNote: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).","fixText":"Use of the OMVS default UID will not be allowed on any Classified system. This is not an issue when using BPX.UNIQUE.USER.\n\nDefine user id used for OMVS account modeling with a non-0 UID, a nonwritable home directory, such as \"\\\" root, and a nonexecutable, but existing, binary file, \"/bin/false\" or \"/bin/echo.\"","ccis":["CCI-000764"]},{"vulnId":"V-223864","ruleId":"SV-223864r1137691_rule","severity":"medium","ruleTitle":"The IBM z/OS startup user account for the z/OS UNIX Telnet Server must be properly defined.","description":"The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TN3270 Telnet Server. Several of these parameters have potential impact to system security. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.","checkContent":"From the ISPF Command Shell enter:\nomvs\ncd /etc\ncat inetd.conf\n\nIf the otelnetd command specifies any user other than OMVS or OMVSKERN, this is a finding.","fixText":"The user account used at the startup of otelnetd is specified in the inetd configuration file. This account is used to perform the identification and authentication of the user requesting the session. Because the account is only used until user authentication is completed, there is no need for a unique account for this function. The z/OS UNIX kernel account can be used.","ccis":["CCI-000213"]},{"vulnId":"V-223865","ruleId":"SV-223865r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS HFS objects for the z/OS UNIX Telnet Server must be properly protected.","description":"HFS directories and files of the z/OS UNIX Telnet Server provide the configuration and executable properties of this product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"From the ISPF Command Shell enter:\nomvs\nAt the input line enter\ncd /usr\nenter\nls -alW\n\nIf the following File permission and user Audit Bits are true, this is not a finding.\n\n/usr/sbin/otelnetd 1740 fff\n\ncd /etc\nls -alW\n\nIf the following file permission and user Audit Bits are true, this is not a finding.\n\n/etc/banner 0744 faf\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing","fixText":"With the assistance of a systems programmer with UID(0) and/or SUPERUSER access, will review the UNIX permission bits and user audit bits on the HFS directories and files for the z/OS UNIX Telnet Server. Ensure they conform to the specifications below:\n\nz/OS UNIX TELNET Server HFS Object Security Settings\nFile Permission Bits User Audit Bits\n/usr/sbin/otelnetd 1740 fff\n/etc/banner 0744 faf\n\nNOTE:\nThe /usr/sbin/otelnetd object is a symbolic link to /usr/lpp/tcpip/sbin/otelnetd. The permission and user audit bits on the target of the symbolic link must have the required settings.\n\nThe following represents a hierarchy for permission bits from least restrictive to most restrictive:\n\n7 rwx (least restrictive)\n6 rw-\n3 -wx\n2 -w-\n5 r-x\n4 r--\n1 --x\n0 --- (most restrictive)\n\nThe possible audit bits settings are as follows:\n\nf log for failed access attempts\na log for failed and successful access\n- no auditing\n\nThe following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:\n\nchmod 1740 /usr/lpp/tcpip/sbin/otelnetd\nchaudit rwx=f /usr/lpp/tcpip/sbin/otelnetd\nchmod 0744 /etc/banner\nchaudit w=sf,rx+f /etc/banner","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223866","ruleId":"SV-223866r958392_rule","severity":"medium","ruleTitle":"The IBM z/OS UNIX Telnet Server etc/banner file must have the Standard Mandatory DoD Notice and Consent Banner.","description":"A logon banner can be used to inform users about the environment during the initial logon. Logon banners are used to warn users against unauthorized entry and the possibility of legal action for unauthorized users, and advise all users that system use constitutes consent to monitoring. Failure to display a logon warning banner without this type of information could adversely impact the ability to prosecute unauthorized users and users who abuse the system.\n\nSatisfies: SRG-OS-000024-GPOS-00007, SRG-OS-000023-GPOS-00006","checkContent":"From UNIX System Services ISPF Shell, enter path \"/etc/otelnet/banner/\".\n\nIf this file does not contain the banner below, check the UNIX System Services ISPF Shell path /etc/banner \nIf neither file contains the banner below this is a finding.\n\nThis banner is mandatory and deviations are not permitted except as authorized in writing by the DoD Chief Information Officer. The thrust of this new policy is to make it clear that there is no expectation of privacy when using DoD information systems and all use of DoD information systems is subject to searching, auditing, inspecting, seizing, and monitoring, even if some personal use of a system is permitted:\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.","fixText":"Configure the /etc/otelnet/banner file and ensure the text specifies a logon banner in accordance with DISA requirements.\nAlternately, the /etc/banner file may be used in accordance with DISA requirements below.\n\nSTANDARD MANDATORY DOD NOTICE AND CONSENT BANNER\n\nYou are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.\n\nBy using this IS (which includes any device attached to this IS), you consent to the following conditions:\n\n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.\n\n-At any time, the USG may inspect and seize data stored on this IS.\n\n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG authorized purpose.\n\n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.\n\n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.","ccis":["CCI-000048","CCI-000050"]},{"vulnId":"V-223867","ruleId":"SV-223867r958586_rule","severity":"medium","ruleTitle":"IBM z/OS UNIX Telnet server Startup parameters must be properly specified.","description":"The z/OS UNIX Telnet Server (i.e., otelnetd) provides interactive access to the z/OS UNIX shell. During the initialization process, startup parameters are read to define the characteristics of each otelnetd instance. Some of these parameters have an impact on system security. Failure to specify the appropriate command options could result in degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.","checkContent":"From the ISPF Command Shell enter:\nISHELL\n\nEnter /etc/ for a pathname - you may need to issue a CD /etc/\nselect FILE NAME inetd.conf\n\nIf Option -D login is included on the otelnetd command, this is not a finding.\n\nIf Option -c 900 is included on the otelnetd command, this is not a finding.\n\nNOTE: \"900\" indicates a session timeout value of \"15\" minutes and is currently the maximum value allowed.","fixText":"Configure the startup parameters in the inetd.conf file for otelnetd to conform to the specifications below.\n\nThe otelnetd startup command includes the options -D login and -c 900, where:\n\n-D login indicates that messages should be written to the syslogd facility for login and logout activity.\n\n-c 900 indicates that the Telnet session should be terminated after \"15\" minutes of inactivity.\n\nNOTE: \"900\" is the maximum value; any value between \"1\" and \"900\" is acceptable.","ccis":["CCI-000366"]},{"vulnId":"V-223868","ruleId":"SV-223868r958586_rule","severity":"medium","ruleTitle":"The IBM z/OS UNIX Telnet server warning banner must be properly specified.","description":"Display of a standardized and approved use notification before granting access to the publicly accessible operating system ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","checkContent":"From the ISPF Command Shell enter:\nISHELL\n\nEnter /etc/ for a pathname - you may need to issue a CD /etc/\nselect FILE NAME inetd.conf\n\nIf Option -h is included on the otelnetd command, this is a finding.","fixText":"Configure the startup parameters in the inetd.conf file for otelnetd to exclude option -h.\nNote: -h indicates that the logon banner should not be displayed.","ccis":["CCI-001384","CCI-001385","CCI-001386","CCI-001387","CCI-001388"]},{"vulnId":"V-223869","ruleId":"SV-223869r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS System datasets used to support the VTAM network must be properly secured.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100","checkContent":"Determine data set names containing all VTAM start options, configuration lists, network resource definitions, commands, procedures, exit routines, all SMP/E TLIBs, and all SMP/E DLIBs used for installation and in development/production VTAM environments.\n\nIf RACF data set rules for all VTAM system data sets restrict access to only network systems programming staff, this is not a finding.\n\nIf RACF data set rules for all VTAM system data sets all READ access to auditors only, this is not a finding.","fixText":"Configure RACF data set rules for all VTAM system data sets restrict access to only network systems programming staff. These data sets include libraries containing VTAM load modules and exit routines, and VTAM start options and definition statements.\n\nAuditors may have READ access as documented by and approved by the ISSM.\n\nThe following sample RACF commands show proper definitions/permissions for VTAM datasets:\n\nAD 'SYS1.VTAM*.**' UACC(NONE) OWNER(SYS1) - \nAUDIT(SUCCESS(UPDATE) FAILURES(READ)) - \nDATA('IBM VTAM DS PROFILE: REF SRR PDI ZVTM0018') \nPE 'SYS1.VTAM.**' ID(<syspsmpl>) ACC(A) \n\nAD 'SYS1.VTAMLIB.**' UACC(NONE) OWNER(SYS1) - \nAUDIT(SUCCESS(UPDATE) FAILURES(READ)) - \nDATA('IBM VTAM APF DS PROFILE: REF SRR PDI ZVTM0018') \nPE 'SYS1.VTAMLIB.**' ID(<syspsmpl>) ACC(A) \n\nAD 'SYS1.VTAM.SISTCLIB.**' UACC(NONE) OWNER(SYS1) -\nAUDIT(SUCCESS(UPDATE) FAILURES(READ)) - \nDATA('IBM VTAM APF DS PROFILE: REF SRR PDI ZVTM0018') \nPE 'SYS1.VTAM.SISTCLIB.**' ID(<syspsmpl>) ACC(A) \n\nAD 'SYS3.VTAM.**' UACC(NONE) OWNER(SYS3) - \nAUDIT(SUCCESS(UPDATE) FAILURES(READ)) - \nDATA('VTAM CUSTOMIZED DS: REF SRR PDI ZVTM0018') \nPE 'SYS3.VTAM.**' ID(<syspsmpl>) ACC(A) \n\nAD 'SYS3.VTAMLIB.**' UACC(NONE) OWNER(SYS3) - \nAUDIT(SUCCESS(UPDATE) FAILURES(READ)) - \nDATA('IBM VTAM APF DS PROFILE: REF SRR PDI ZVTM0018')\nPE 'SYS3.VTAMLIB.**' ID(<syspsmpl>) ACC(A) \n\nSETR GENERIC(DATASET) REFRESH","ccis":["CCI-000213","CCI-001499"]},{"vulnId":"V-223870","ruleId":"SV-223870r991560_rule","severity":"medium","ruleTitle":"IBM z/OS VTAM USSTAB definitions must not be used for unsecured terminals.","description":"If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.","checkContent":"Ask the system administrator to supply the following information:\n\n- Documentation regarding terminal naming standards.\n- Documentation of all procedures controlling terminal logons to the system.\n- A complete list of all USS commands used by terminal users to log on to the system.\n- Members and data set names containing USSTAB and LOGAPPL definitions of all terminals that can log on to the system (e.g., SYS1.VTAMLST).\n- Members and data set names containing logon mode parameters.\n\nIf USSTAB definitions are only used for secure terminals (e.g., terminals that are locally attached to the host or connected to the host via secure leased lines), this is not a finding.\n\nIf USSTAB definitions are used for any unsecured terminals (e.g., dial up terminals or terminals attached to the Internet such as TN3270 or KNET 3270 emulation), this is a finding.","fixText":"Configure USSTAB definitions to be only used for secure terminals.\n\nOnly terminals that are locally attached to the host or connected to the host via secure leased lines located in a secured area. Only authorized personnel may enter the area where secure terminals are located. \n\nUSSTAB or LOGAPPL definitions are used to control logon from secure terminals. These terminals can log on directly to any VTAM application (e.g., TSO, CICS, etc.) of their choice and bypass Session Manager services. Secure terminals are usually locally attached to the host or connected to the host via a private LAN without access to an external network. Only authorized personnel may enter the area where secure terminals are located.","ccis":["CCI-001499"]},{"vulnId":"V-230209","ruleId":"SV-230209r1137691_rule","severity":"medium","ruleTitle":"The IBM RACF System REXX IRRPHREX security data set must be properly protected.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.\n\nAccess control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.\n\nThis requirement also applies to Zero Trust initiatives.","checkContent":"Refer to the zOS system REXXLIB concatenation found in SYS1. PARMLIB (AXR) for the data set that contains the REXX for Password exit named IRRPHREX and the defined AXRUSER.\n\nIf the following guidance is true, this is not a finding.\n\n-RACF data set access authorizations restrict READ to AXRUSER, z/OS systems programming personnel, security personnel, and auditors.\n-RACF data set access authorizations restrict UPDATE to security personnel using a documented change management procedure to provide a mechanism for access and revoking of access after use.\n-All (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, and CONTROL) is logged.\n-RACF data set access authorizations specify UACC(NONE) and NOWARNING.","fixText":"Configure read access to be restricted to security administrators, systems programmers, and auditors.\n\nEstablish a procedure documented with the ISSM that defines a change management process to provide mechanism for granting Update access to security administrators on an exception basis. The process should contain procedures to revoke access when documented update is completed.\n\nConfigure all failures and successes data set access authorities for RACF data set that contains the Password exit to be logged.\n\nExamples:\nad 'sys3.racf.rexxlib.**' uacc(none) owner(sys3) -\naudit(all(read)) \nPermit 'sys3.racf.rexxlib.**' id(<syspsmpl> <secasmpl> <smplsmpl> AXRUSER) acc(r)\nPermit 'sys3.racf.rexxlib.**' id(<secasmpl>) acc(u)","ccis":["CCI-000213"]},{"vulnId":"V-230210","ruleId":"SV-230210r998382_rule","severity":"medium","ruleTitle":"IBM RACF exit ICHPWX11 for password phrases must be installed and properly configured.","description":"Use of a complex password phrase helps to increase the time and resources required to compromise the password. Password phrase complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword phrase complexity is one factor of several that determines how long it takes to crack a password. The more complex the password phrase, the greater the number of possible combinations that need to be tested before the password is compromised.","checkContent":"From a system console screen issue the following modify command:\nF AXR,IRRPHREX LIST\n\nReview the results of the modify command. \n\nIf all of the following options are listed, this is not a finding.\n\n-The number of required character types is four.\n(ensures that at least one uppercase, one lowercase, one number, and one special character is used in password phrase)\n\n-The user's name is not contained in the password phrase.\n(Only three consecutive characters of the user's name are allowed)\n\n-The minimum password phrase length checked is 15.\n\n-The user ID is not contained in the password phrase.\n(Only three consecutive characters of the user ID are allowed)\n\n-The new password phrase is at least 50 percent changed positions of the old password phrase.\n(These positions need to be consecutive to cause a failure and this check is not case sensitive)\n\n-A minimum list of eight restricted words are being checked:\n'IBM' , 'RACF', 'PASSWORD', 'PHRASE', 'PASSPHRASE', 'SECRET', 'IBMUSER', 'SYS1'\n\nIf the modify command fails or returns the following message in the system log, this is a finding.\n\nIRX0406E REXX exec load file REXXLIB does not contain exec member IRRPHREX.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nFor z/OS release 1.12 through z/OS release 2.1, APARs OA43998 and OA43999 must be applied.\n\nInstall exit IRRPHREX according to the following guidelines:\nREXX Parameter Setting\n\nPhr_minlen = 15 /* Minimum length */\nPhr_maxlen = 100 /* Maximum passphrase length */\nnumbers = '0123456789' \nletters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' \nspecial = '&*@ :=!-%.#?|-' \" \nPhr_allowed_chars = numbers||letters||special \nPhr_leading_blanks = 'no' \nPhr_trailing_blanks = 'no' \nPhr_name_allowed = 'no' \nPhr_name_minlen = 3 \nPhr_repeat_chars_chk = 'yes' \nPhr_userid_allowed = 'no' \nPhr_req_types = 4 \nPhr_min_unique = Phr_minlen % 2 /* 'Half' of chars must be unique  */  \nPhr_min_unique_norm = 'yes' \nPhr_word_unique = 0 \nPhr_word_unique_upper = 'yes' \nPhr_word_minlen = 4 \nPhr_dict.1 = 'IBM' \nPhr_dict.2 = 'RACF' \nPhr_dict.3 = 'PASSWORD'\nPhr_dict.4 = 'PHRASE' \nPhr_dict.5 = 'PASSPHRAS\nPhr_dict.6 = 'SECRET' \nPhr_dict.7 = 'IBMUSER' \nPhr_dict.8 = 'SYS1'\n\nNote: RACF exit ICHPHX11 is coded to call a System REXX named IRRPHREX, so the name cannot be changed without a corresponding change to ICHPWX11.\n\nSystem REXX requires that this exec (IRRPHREX) reside in the REXXLIB concatenation.\n\nUpdate parameters in IRRPHREX according to table Parameters for RACF IRRPWREX as listed above.","ccis":["CCI-004066"]},{"vulnId":"V-235033","ruleId":"SV-235033r1137691_rule","severity":"medium","ruleTitle":"IBM RACF must limit WRITE or greater access to LINKLIST libraries to system programmers only.","description":"The primary function of the LINKLIST is to serve as a single repository for commonly used system modules. Failure to ensure that the proper set of libraries is designated for LINKLIST can impact system integrity, performance, and functionality. For this reason, controls must be employed to ensure that the correct set of LINKLIST libraries is used. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n\nSatisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000259-GPOS-00100, SRG-OS-000324-GPOS-00125","checkContent":"From Any ISPF input line, enter:\nTSO ISRDDN LINKLIST\n\nIf all of the following are untrue, this is not a finding.\n\nIf any of the following is true, this is a finding.\n\n-The ACP data set rules for LINKLIST libraries do not restrict WRITE or greater access to only z/OS systems programming personnel.\n-The ACP data set rules for LINKLIST libraries do not specify that all (i.e., failures and successes) WRITE or greater access will be logged.","fixText":"Review access authorization to critical system files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes as required to protect the LINKLIST libraries.\n\nConfigure the WRITE or greater access to LINKLIST libraries to be limited to system programmers only and all WRITER or greater access is logged.","ccis":["CCI-000213","CCI-001499","CCI-002235"]},{"vulnId":"V-245536","ruleId":"SV-245536r991589_rule","severity":"medium","ruleTitle":"The IBM z/OS TCPIP.DATA configuration statement must contain the DOMAINORIGIN or DOMAIN specified for each TCP/IP defined.","description":"If data origin authentication and data integrity verification are not performed, the resultant response could be forged, it may have come from a poisoned cache, the packets could have been intercepted without the resolver's knowledge, or resource records could have been removed which would result in query failure or denial of service. Data origin authentication verification must be performed to thwart these types of attacks.\n\nEach client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching Domain Name System (DNS) servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.\n\nThis is not applicable if DNSSEC is not implemented on the local network.","checkContent":"Refer to the Data configuration file specified on the SYSTCPD DD statement in the TCPIP started task JCL.\n\nNote:\nIf GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.\n\nIf GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.\n\nIf the DOMAINORIGIN/DOMAIN (the DOMAIN statement is functionally equivalent to the DOMAINORIGIN statement) is specified in the TCP/IP Data configuration file, this is not a finding.","fixText":"Configure the TCPIP.DATA file to include the DOMAINORIGIN/DOMAIN (the DOMAIN statement is functionally equivalent to the DOMAINORIGIN statement).   \n\nNote:\nIf GLOBALTCPIPDATA is specified, any TCPIP.DATA statements contained in the specified file or data set take precedence over any TCPIP.DATA statements found using the appropriate environment's (native MVS or z/OS UNIX) search order.\n\nIf GLOBALTCPIPDATA is not specified, the appropriate environment's (Native MVS or z/OS UNIX) search order is used to locate TCPIP.DATA.","ccis":["CCI-000366"]},{"vulnId":"V-251107","ruleId":"SV-251107r1137695_rule","severity":"medium","ruleTitle":"IBM z/OS sensitive and critical system data sets must not exist on shared DASDs.","description":"Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to information systems. The control of information in shared resources is also commonly referred to as object reuse and residual information protection.\n\nThis requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular information system components that are, or use, such products. This can be verified by acceptance/validation processes in DoD or other government agencies.\n\nThere may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific information system components.","checkContent":"Check HMC, VM, and z/OS on how to validate and determine a DASD volume(s) is shared.\n\nNote: In VM issue the command \"QUEUE DASD SYSTEM\" this display will show shared volume(s) and indicates the number of systems sharing the volume.\n\nValidate all machines that require access to these shared volume(s) have the volume(s) mounted.\n\nObtain a map or list VTOC of the shared volume(s).\n\nCheck if shared volume(s) contain any critical or sensitive data sets.\n\nIdentify shared and critical or sensitive data sets on the system being audited. These data sets can be APF, LINKLIST, LPA, Catalogs, etc, as well as product data sets.\n\nIf all of the critical or sensitive data sets identified on shared volume(s) are protected and justified to be on shared volume(s), this is not a finding.\n\nList critical or sensitive data sets are possible security breaches, if not justified and not protected on systems having access to the data set(s) and on shared volume(s).","fixText":"Configure all identified volumes of shared DASD to be valid within the following.\n\nHMC\nVM\nz/OS\n\nIf the shared volume(s) are valid and systems having access to these shared volume(s) are valid, map disk/VTOC list to obtain data sets on the shared volume(s). From this list obtain a list of sensitive and critical system data sets that are found on the shared volume(s). Ensure that the data sets are justified to be shared on the system and to reside on the shared volume(s).\n\nThe ISSO will review all access requirements to validate that sensitive and critical system data sets are protected from unauthorized access across all systems that have access to the shared volume(s), protecting the data set(s) whether the data set(s) are used or not used on the systems that have the shared volume(s) available to them.","ccis":["CCI-001090"]},{"vulnId":"V-252553","ruleId":"SV-252553r1137691_rule","severity":"medium","ruleTitle":"IBM z/OS TCP/IP AT-TLS policy must be properly configured in Policy Agent.","description":"If events associated with nonlocal administrative access or diagnostic sessions are not logged, a major tool for assessing and investigating attacks would not be available.\n\nThis requirement addresses auditing-related issues associated with maintenance tools used specifically for diagnostic and repair actions on organizational information systems.\n\nNonlocal maintenance and diagnostic activities are conducted by individuals communicating through an external network (e.g., the internet) or an internal network. Local maintenance and diagnostic activities are carried out by individuals physically present at the information system or information system component and not communicating across a network connection.\n\nThis requirement applies to hardware/software diagnostic test equipment or tools. This requirement does not cover hardware/software components that may support information system maintenance, yet are a part of the system; for example, the software implementing \"ping,\" \"ls,\" \"ipconfig,\" or the hardware and software implementing the monitoring port of an Ethernet switch.","checkContent":"Use the z/OS UNIX pasearch -t command to query information from the z/OS UNIX Policy Agent. \n\nThe command is issued from the UNIX System Services shell.\n\nExamine the results for AT-TLS initiation and control statements.\n\nIf there are no AT-TLS initiation and controls statements this is a finding.\n\nVerify the statements specify a FIPS 140-2 compliant value. If none of the following values are present, this is a finding\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256","fixText":"Develop a plan of action to implement the required changes. Ensure the following items are in effect for TCP/IP resources.\n\nDevelop AT-TLS policy. Install in the policy agent.\n\nEnsure that the statements specify a FIPS 140-2 compliant value of the following values.\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256","ccis":["CCI-000067"]},{"vulnId":"V-255935","ruleId":"SV-255935r991589_rule","severity":"medium","ruleTitle":"IBM Integrated Crypto Service Facility (ICSF) Configuration parameters must be correctly specified.","description":"IBM Integrated Crypto Service Facility (ICSF) product has the ability to use privileged functions and/or have access to sensitive data. Failure to properly configure parameter values could potentially the integrity of the base product which could result in compromising the operating system or sensitive data.","checkContent":"Refer to the CSFPRMxx member in the logical PARMLIB concatenation.\n\nIf the configuration parameters are specified as follows this is not a finding. \n\nREASONCODES(ICSF) \nCOMPAT(NO) \nSSM(NO) \nSSM can be dynamically set by defining the CSF.SSM.ENABLE SAF profile within the XFACILIT resource\nClass. If this profile is not limited to authorized personnel this is a finding.\nCHECKAUTH(YES) \nFIPSMODE(YES,FAIL(YES))\nAUDITKEYLIFECKDS (TOKEN(YES),LABEL(YES)).\nAUDITKEYLIFEPKDS (TOKEN(YES),LABEL(YES)).\nAUDITKEYLIFETKDS (TOKENOBJ(YES),SESSIONOBJ(YES)).\nAUDITKEYUSGCKDS (TOKEN(YES),LABEL(YES),INTERVAL(n)).\nAUDITKEYUSGPKDS (TOKEN(YES),LABEL(YES),INTERVAL(n)).\nAUDITPKCS11USG (TOKENOBJ(YES),SESSIONOBJ(YES),NOKEY(YES),INTERVAL(n)).\n\nDEFAULTWRAP -This parameter can be determined by the site. ENHANCED wrapping specifies the new X9.24 compliant CBC wrapping is used.  \nIf DEFAULTWRAP is not specified, the default wrapping\nmethod will be ORIGINAL for both internal and external tokens.  Starting with ICSF FMID HCR77C0, the value for this option can be updated without restarting ICSF by using either the SETICSF command or the ICSF Multi-Purpose service. If this access is not restricted to appropriate personnel, this is a finding. (\nNote: Other options may be site defined.","fixText":"Evaluate the impact associated with implementation of the control options. Develop a plan of action to implement the control options for CSFPRMxx as specified below:\n\nREASONCODES(ICSF) \nCOMPAT(NO) \nSSM(NO) \nSSM can be dynamically set by defining the CSF.SSM.ENABLE SAF profile within the XFACILIT resource\nClass. This profile must limited to authorized personnel.\n\nCHECKAUTH(YES) \nFIPSMODE(YES,FAIL(YES))\nAUDITKEYLIFECKDS (TOKEN(YES),LABEL(YES)).\nAUDITKEYLIFEPKDS (TOKEN(YES),LABEL(YES)).\nAUDITKEYLIFETKDS (TOKENOBJ(YES),SESSIONOBJ(YES)).\nAUDITKEYUSGCKDS (TOKEN(YES),LABEL(YES),INTERVAL(n)).\nAUDITKEYUSGPKDS (TOKEN(YES),LABEL(YES),INTERVAL(n)).\nAUDITPKCS11USG (TOKENOBJ(YES),SESSIONOBJ(YES),NOKEY(YES),INTERVAL(n)).\n\n\nDEFAULTWRAP -This parameter can be determined by the site. ENHANCED wrapping specifies the new X9.24 compliant CBC wrapping is used.  \nIf DEFAULTWRAP is not specified, the default wrapping\nmethod will be ORIGINAL for both internal and external tokens.  Starting with ICSF FMID HCR77C0, the value for this option can be updated without restarting ICSF by using either the SETICSF command or the ICSF Multi-Purpose service. This access must be restricted to appropriate personnel. \nNote: Other options may be site defined.","ccis":["CCI-000366"]},{"vulnId":"V-255936","ruleId":"SV-255936r1137691_rule","severity":"medium","ruleTitle":"IBM Integrated Crypto Service Facility (ICSF) install data sets are not properly protected.","description":"IBM Integrated Crypto Service Facility (ICSF) product has the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.","checkContent":"If the ESM dataset rules for the  IBM Integrated Crypto Service Facility (ICSF) install data sets  does not restrict UPDATE and/or ALTER access to systems programming personnel this is a finding.\n\nIf the ESM  data set rules for  IBM Integrated Crypto Service Facility (ICSF) install data set does not specify that all (i.e., failures and successes) UPDATE and/or ALTER access will be logged this is a finding.","fixText":"Ensure that update and allocate access to IBM Integrated Crypto Service Facility (ICSF) install data sets is limited to System Programmers only, and all update and allocate access is logged. Read access can be given to Auditors and any other users that have a valid requirement to utilize these data sets.\n\nThe installing Systems Programmer will identify and document the product data sets and categorize them according to who will have update and alter access and if required that all update and allocate access is logged.  He will identify if any additional groups have update access for specific data sets, and once documented he will work with the IAO to see that they are properly restricted to the ACP (Access Control Program) active on the system.\n\nData sets to be protected will be: \nSYS1.CSF\n\nThe following commands are provided as a sample for implementing data set controls: \n\nad 'SYS1.CSF.**' uacc(none) owner(sys1) -\n\taudit(success(update) failures(read)) -\n\tdata('Vendor DS Profile: icsf')\npe 'SYS1.CSF.**' id(syspaudt tstcaudt) acc(a)\npe 'SYS1.CSF.**' id(icsfusrs) acc(r)\n\nad 'sys1.csf.scsfmod0.**' owner(sys1) \n data('apf auth icsf ds') -\n audit(success(update) failures(read)) uacc(none)               \npe 'sys1.csf.scsfmod0.**' id(syspaudt tstcaudt) acc(a)                    \n\nsetr generic(dataset) refresh","ccis":["CCI-000213","CCI-002264"]},{"vulnId":"V-255937","ruleId":"SV-255937r958482_rule","severity":"medium","ruleTitle":"IBM Integrated Crypto Service Facility (ICSF) Started Task name is not properly identified / defined to the system ACP.","description":"IBM Integrated Crypto Service Facility (ICSF) requires a started task that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.","checkContent":"From the ISPF Command Shell-\n enter ListUser\n\nIf the userid(s) for the IBM Integrated Crypto Service Facility (ICSF) started task is not defined to the security database, this is a finding.","fixText":"Ensure that the started task for IBM Integrated Crypto Service Facility (ICSF) Started Task(s) is properly Identified / defined to the System ESM.\n\nIf the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes.\n\nMost installation manuals will indicate how the Started Task is identified and any additional attributes that must be specified.  Define the started task userid CSFSTART for IBM Integrated Crypto Service Facility (ICSF).\n\nExample:\n\nAU CSFSTART NAME('STC, ICSF') NOPASS -\n\tOWNER(STC) DFLTGRP(STC) -\n\t DATA('START ICSF')","ccis":["CCI-000764"]},{"vulnId":"V-255938","ruleId":"SV-255938r958482_rule","severity":"medium","ruleTitle":"IBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the STARTED resource class for RACF.","description":"Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources.  Improper control of product resources could potentially compromise the operating system, ACP, and customer data.","checkContent":"Execute the RACF DSMON report for RACSPT\n\nif the IBM Integrated Crypto Service Facility (ICSF) started task(s) is (are)  not defined to the STARTED resource class profile and/or ICHRIN03 table entry this is a finding","fixText":"Ensure that a product's started task(s) is (are) properly identified and/or defined to the System ACP.  \n\nA unique userid must be assigned for the IBM Integrated Crypto Service Facility (ICSF) started task(s) thru a corresponding STARTED class entry.\n\nThe following sample set of commands is shown here as a guideline:\n\nrdef started CSFSTART.** uacc(none) owner(admin) audit(all(read)) stdata(user(CSFSTART) group(stc))\n\nsetr racl(started) ref","ccis":["CCI-000764"]},{"vulnId":"V-255939","ruleId":"SV-255939r991560_rule","severity":"medium","ruleTitle":"IBM Integrated Crypto Service Facility (ICSF) STC data sets must be properly protected.","description":"IBM Integrated Crypto Service Facility (ICSF) STC data sets have the ability to use privileged functions and/or have access to sensitive data.  Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.","checkContent":"Verify that access to the IBM Integrated Crypto Service Facility (ICSF) STC data sets are properly restricted. The data sets to be protected are identified in the data set referenced in the CSFPARM DD statement of the ICSF started task(s) and/or batch job(s); the entries for CKDSN and PKDSN specify the data sets.\n\nIf the RACF data set access authorizations do not restrict READ access to auditors, this is a finding\n\nIf the  RACF data set access authorizations do not restrict WRITE and/or greater access to systems programming personnel, this is a finding.\n\nIf the RACF data set access authorizations do not  restrict WRITE and/or greater access to the product STC(s) and/or batch job(s), this is a finding.","fixText":"Ensure that WRITE and/or greater access to IBM Integrated Crypto Service Facility (ICSF) STC and/or batch data sets are limited to system programmers and ICSF STC and/or batch jobs only.  READ access can be given to auditors at the ISSOs discretion.\n\nThe installing Systems Programmer will identify and document the product data sets and categorize them according to who will have what type of access and if required, which type of access is logged.  The installing systems programmer will identify any additional groups requiring access to specific data sets, and once documented the installing systems programmer will work with the ISSO to confirm that they are properly restricted to the ACP (Access Control Program) active on the system.\n\n(Note: The data sets and/or data set prefixes identified below are examples of a possible installation. The actual data sets and/or prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.)\n\nThe data sets to be protected are identified in the data set referenced in the CSFPARM DD statement of the ICSF started task(s) and/or batch job(s); the entries for CKDSN and PKDSN specify the data sets.\n\nNote: Currently on most CSD systems, the CKDSN specifies SYS3.CSF.CKDS, and PKDSN specifies SYS3.CSF.PKDS.\n\nThe following commands are provided as a sample for implementing data set controls:\n\nad 'sys3.csf.**' uacc(none) owner(sys3) -\naudit(failures(read)) -\ndata('ICSF Output Data')\npe 'sys3.csf.**' id(syspaudt) acc(a)\npe 'sys3.csf.**' id(tstcaudt) acc(a)\npe 'sys3.csf.**' id(icsfstc) acc(a)\npe 'sys3.csf.**' id(audtaudt) acc(r)","ccis":["CCI-001499"]},{"vulnId":"V-257135","ruleId":"SV-257135r998383_rule","severity":"medium","ruleTitle":"IBM Passtickets must be configured to be KeyEncrypted.","description":"Passwords such as IBM Passtickets need to be protected at all times, and encryption is the standard method for protecting such passwords. If passwords are not encrypted, they may be plainly read (i.e., clear text) and easily compromised.","checkContent":"From the ISPF Command Shell enter:\n\nRList PTKTDATA * SSIGNON NORACF\n\nIf any profile is not defined as KEYENCRYPTED, this is a finding.","fixText":"Ensure that all Passticket profiles are configured to be KeyEncrypted.","ccis":["CCI-004062"]},{"vulnId":"V-272875","ruleId":"SV-272875r1082845_rule","severity":"medium","ruleTitle":"IBM z/OS FTP Control cards must be properly stored in a secure PDS file.","description":"Configuring the operating system to implement organizationwide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DOD that reflects the most restrictive security posture consistent with operational requirements.","checkContent":"Provide a list(s) of the locations for all FTP Control cards within a given application/AIS, ensuring no FTP control cards are within in-stream JCL, JCL libraries, or any open access data sets. The list(s) must indicate which application uses the PDS and access requirements for those PDSs (who and what level of access). Lists/spreadsheets used for documenting the meeting of this requirement must be maintained by the responsible Application/AIS Team, available upon request and not maintained by the Mainframe ISSO.\n\nObtain the list/spreadsheet from the Application/AIS Team.\n\nAccess to FTP scripts and/or data files located on host system(s) that contain FTP userid and or password will be restricted to those individuals responsible for the application connectivity and who have a legitimate requirement to know the userid and password on a remote system. \n\nFTP Control Cards within in-stream JCL, within JCL libraries, or open access libraries/data sets is a finding. \n\nIf there is anyone not listed within the spreadsheet by userid that has access of Read or greater to the FTP control cards, this is a finding.","fixText":"Create a list or spreadsheet of the locations where FTP control cards are stored, who should have access to those libraries, and which applications use the FTP control cards.\n\nAdd columns for users permitted access to the secured PDS.\n\nMake sure the FTP control Cards for each FTP are stored in a secure PDS and that they are not placed in the JCL libraries or in the in-stream JCL for each FTP.","ccis":["CCI-000366"]},{"vulnId":"V-272877","ruleId":"SV-272877r1130282_rule","severity":"medium","ruleTitle":"IBM z/OS started tasks for the Base TCP/IP component must be defined in accordance with security requirements.","description":"To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system.\n\nOrganizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and processes acting on behalf of users) must be uniquely identified and authenticated to all accesses, except for the following: \n\n1) Accesses explicitly identified and documented by the organization. Organizations document specific user actions that can be performed on the information system without identification or authentication; and\n\n2) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals in group accounts (e.g., shared privilege accounts) or for detailed accountability of individual activity.","checkContent":"Refer to system Proclibs to determine the TCPIP address space(s).\n\nFrom the ISPF Command Shell, enter:\nLISTUSER<TCPIP STCs>  OMVS\n\nFor each TCPIP:\n-Named TCPIP or, in the case of multiple instances, prefixed with TCPIP.\n-Has the STC facility. \n\n-z/OS Unix attributes: \nUID(0), HOME directory '/', shell program /bin/sh \nIf all of the following items are true, this is not a finding.\n\nIf any item is untrue, this is a finding.\n\nFrom the ISPF Command Shell, enter:\nLISTUSER EZAZSSI OMVS\nIf EZAZSSI STC has the STC facility, this is not finding.\n\nEnsure the following items are in effect for the USERID assigned to the EZAZSSI started task: \n-Named EZAZSSI. \n-Has the STC facility.","fixText":"Develop a plan of action to implement the required changes. Ensure the following items are in effect for the ACID(s) assigned to the TCP/IP address space(s): \n\n1) Named TCPIP or, in the case of multiple instances, prefixed with TCPIP.\n\n2) Has the STC facility.\n\n3) z/OS Unix attributes: UID(0), HOME directory '/', shell program /bin/sh.\n\nEnsure the following items are in effect for the USERID assigned to the EZAZSSI started task: \n\n1) Named EZAZSSI.\n\n2) Has the STC facility. \n\nFor example:\n\nThe following commands can be used to create the user accounts and assign the privileges that are required for the TCP/IP address space and the EZAZSSI started task:\n\n1) Define a userid for the TCPIP Address space. A sample command is shown here:\n\nADDUSER TCPIP NAME('STC, TCPIP') NOPASS DFLTGRP(STCTCPX) OWNER(STCTCPX) OMVS(UID(0) HOME('/') PROGRAM('/bin/sh'))\n\n2) Define a matching entry in the STARTED Class. A sample command is shown here:\n\nRDEFINE STARTED TCPIP.** UACC(NONE) OWNER(ADMN) AUDIT(ALL(READ)) STDATA(USER(TCPIP) GROUP(STCTCPX) TRACE(YES))\n\n3) Set up the RACF userid for the EZAZSSI Proc. A sample command to accomplish this is shown here:\n\nAU EZAZSSI NAME('STC, EZAZSSI') NOPASS OWNER(STCTCPX) DFLTGRP(STCTCPX) \n\n4) Define a matching entry in the STARTED class for the EZAZSSI proc. A sample command to accomplish this is shown here:\n\nRDEF STARTED EZAZSSI.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER(EZAZSSI) GROUP(STCTCPX) TRACE(YES))","ccis":["CCI-000764"]},{"vulnId":"V-272879","ruleId":"SV-272879r1082934_rule","severity":"medium","ruleTitle":"IBM z/OS DFSMS control data sets must reside on separate storage volumes","description":"Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.","checkContent":"Review the logical parmlib data sets, for example SYS1.PARMLIB(IGDSMSxx), to identify the fully qualified file names for the following SMS data sets:\nActive Control Data Set (ACDS)\nCommunications Data Set (COMMDS)\n\nIf the COMMDS and ACDS SMS data sets identified above reside on different volumes, this is not a finding.\n\nIf the COMMDS and ACDS SMS data sets identified above are collocated on the same volume, this is a finding.","fixText":"Allocate the primary and backup SMS Control data sets on separate volumes.\n\nSource Control Data Set (SCDS) contains an SMS configuration, which defines a storage management policy.\n\nActive Control Data Set (ACDS) contains a copy of the most recently activated configuration. All systems in an SMS complex use this configuration to manage storage.\n\nCommunications Data Set (COMMDS) contains the name of the ACDS containing the currently active storage management policy, the current utilization statistics for each system managed volume, and other system information.\n\nThe ACDS data set will reside on a different volume than the COMMDS data set.\n\nAllocate backup copies of the ADCS and COMMDS data sets on a different shared volume from the primary ACDS and COMMDS data sets.","ccis":["CCI-000366","CCI-000549"]},{"vulnId":"V-275952","ruleId":"SV-275952r1137691_rule","severity":"medium","ruleTitle":"zOSMF resource class(es) must be active in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF command shell enter:\nSETRopts list\n\nIf the ACTIVE CLASSES list the EJBROLE, LOGSTRM, SERVER, TSOPROC, ZMFAPLA, and ZMFCLOUD, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETRopts LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe above Classes are activated with the command:\nSETRopts CLASSACT(EJBROLE, LOGSTRM, SERVER, TSOPROC, ZMFAPLA, and ZMFCLOUD).","ccis":["CCI-000213"]},{"vulnId":"V-275953","ruleId":"SV-275953r1137691_rule","severity":"medium","ruleTitle":"The ICSF resource class(es) must be active in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF command shell, enter:\nSETRopts list\n\nIf the ACTIVE CLASSES list the CRYPTOZ, CSFKEYS, CSFSERV, GCSFKEYS , GXCSFKEY, and XCSFKEY resource classes, this is not a finding.","fixText":"Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:\n\nThe RACF Command SETRopts LIST will show the status of RACF Controls including a list of ACTIVE classes. \n\nThe above Classes are activated with the command:\nSETRopts CLASSACT(CRYPTOZ, CSFKEYS, CSFSERV, GCSFKEYS, GXCSFKEY, XCSFKEY","ccis":["CCI-000213"]},{"vulnId":"V-275954","ruleId":"SV-275954r1174000_rule","severity":"medium","ruleTitle":"ICSF resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF command shell, for each following resource classes:\n{CRYPTOZ, CSFKEYS, CSFSERV, GCSFKEYS , GXCSFKEY, and XCSFKEY}\nenter\n\nRL <Class>  * AUTHUSER\n\nConsult the ISCF Administrator, security administrator and the site security plan for appropriate user access.\n\nIf RACF access rules for each resource are restricted to appropriate users, this is not a finding.","fixText":"Configure access for resources in accordance with the site security plan.","ccis":["CCI-000213"]},{"vulnId":"V-275956","ruleId":"SV-275956r1174003_rule","severity":"medium","ruleTitle":"zOSMF resources must be protected in accordance with security requirements.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"From the ISPF command shell, for each appropriate resource class enter:\nRL <Class>  * AUTHUSER\nFor  EJBROLE, LOGSTRM,  SERVER, TSOPROC, ZMFAPLA AND ZMFCLOUD resources class.\n\nReview Appendix A in the zOSMF Configuration Guide: Security Structures for z/OSMF Requirements for the Security Configuration tables.\n\nIf RACF access rules for each resource are restricted to appropriate users, this is not a finding.","fixText":"Review the access requirements in the Appendix A in the zOSMF Configuration Guide: Security Structures for z/OSMF Requirements for the Security Configuration tables.\n\nConfigure access for resources in accordance with the site security plan.","ccis":["CCI-000213"]}]}