{"stig":{"title":"zOS WebSphere MQ for RACF Security Technical Implementation Guide","version":"7","release":"3"},"checks":[{"vulnId":"V-224551","ruleId":"SV-224551r1145040_rule","severity":"high","ruleTitle":"WebSphere MQ channel security must be implemented in accordance with security requirements.","description":"WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.\n\nSatisfies: SRG-OS-000505, SRG-OS-000555","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid).\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nCollect the following Information for WebSphere MQ queue manager.\n\n- If a WebSphere MQ queue manager communicates with another WebSphere MQ queue manager, provide the WebSphere MQ queue manager and channel names used to connect these queue managers.\n\nAutomated Analysis requires Additional Analysis.\nAutomated Analysis\nRefer to the following report produced by the z/OS Data Collection:\n\n- PDI(ZWMQ0011).\n\nIf the following guidelines are true for each channel definition displayed from the DISPLAY CHANNEL command, this is not a finding.\n\nVerify that each WebSphere MQ channel is using SSL by checking for the SSLCIPH parameter, which must specify a FIPS 140-2 compliant value of the following: (Note: Both ends of the channel must specify the same cipher specification.)\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256\n\nRepeat the above step for each queue manager ssid identified.","fixText":"Review the WebSphere MQ Screen interface invoked by the REXX CSQOREXX. Reviewing the channel's SSLCIPH setting.\n\nDisplay the channel properties and look for the \"SSL Cipher Specification\" value.\n\nEnsure that a FIPS 140-2 compliant value is shown.\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256\n\nNote that both ends of the channel must specify the same cipher specification. \n\nRepeat these steps for each queue manager ssid identified.","ccis":["CCI-000068","CCI-002421","CCI-002423","CCI-002450"]},{"vulnId":"V-224552","ruleId":"SV-224552r1145043_rule","severity":"medium","ruleTitle":"WebSphere MQ channel security is not implemented in accordance with security requirements.","description":"WebSphere MQ channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. WebSphere MQ channels use SSL encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid).\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nTo determine which Release of WebSphere MQ, review ssid reports for message CSQU000I. Collect the following Information for each WebSphere MQ queue manager. \n\n- If a WebSphere MQ queue manager communicates with another WebSphere MQ queue manager, provide the WebSphere MQ queue manager and channel names used to connect these queue managers.\n- If any WebSphere MQ channels are used to communicate within the enclave, provide a list of channels and provide documentation regarding the sensitivity of the information on the channel.\n\nReview the ssid report(s) and perform the following steps. If the following guidance for each queue manager ssid is true, this is not a finding.\n\nFind the DISPLAY QMGR DEADQ, SSLKEYR, SCYCASE command to locate the start of the Queue Manager definitions.\n\nVerify that each WebSphere MQ 5.3 queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified. i.e. SSLKEYR(sslkeyring-id).\n\nIssue the following RACF commands, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtained from the above action:\n\nRACDCERT ID(ssidCHIN) LISTRING(sslkeyring-id)\n\nNote: The sslkeyring-id is case sensitive.\n\nThe output will contain columns for Certificate Label Name and Cert Owner. Find the Cert Owner of ID(ssidCHIN). Use the Certificate Label Name for ID(ssidCHIN) in the following command:\n\nRACDCERT ID(ssidCHIN) LIST(LABEL('Certificate Label Name'))\n\nNote: The Certificate Label Name is case sensitive.\n\nReview the Issuer's Name field in the resulting output for information on any of the following:\n\nOU=PKI.OU=DoD.O=U.S. Government.C=US\nOU=ECA.O=U.S. Government.C=US\n\nRepeat these steps for each queue manager ssid identified.","fixText":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier). \n\nFind the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions.\nVerify that each WebSphere MQ queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified, i.e., SSLKEYR(sslkeyring-id).\nIssue the following RACF commands, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtained from the above action:\n\nRACDCERT ID(ssidCHIN) LISTRING(sslkeyring-id)\n\nNote: The sslkeyring-id is case sensitive.\n\nThe output will contain columns for Certificate Label Name and Cert Owner. Find the Cert Owner of ID(ssidCHIN). Use the Certificate Label Name for ID(ssidCHIN) in the following command:\n\nRACDCERT ID(ssidCHIN) LIST(LABEL('Certificate Label Name'))\n\nNote: The Certificate Label Name is case sensitive.\n\nReview the Issuer's Name field in the resulting output for information on any of the following:\n\nOU=PKI.OU=DoD.O=U.S. Government.C=US\nOU=ECA.O=U.S. Government.C=US\n\nRepeat these steps for each queue manager ssid identified.\n\nTo implement the requirements stated above, the following two items are provided which attempt to assist with (1) Technical \"how to\" information and (2) A DISA Point of contact for obtaining SSL certificates for CSD WebSphere MQ channels:\n\nReview the information available on setting up SSL, Keyrings, and Digital Certificates in the RACF Security Administrator's Guide as well as the WebSphere MQ Security manual. Also review the information contained in the documentation provided as part of the install package from the DISA SSO Resource Management Factory (formerly Software Factory).\n\nFor information on obtaining an SSL certificate in the DISA CSD environment, send email inquiry to disaraoperations@disa.mil.","ccis":["CCI-002470"]},{"vulnId":"V-224553","ruleId":"SV-224553r1145045_rule","severity":"medium","ruleTitle":"Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF).","description":"IBM WebSphere MQ can use a user ID associated with an ACP certificate as a channel user ID. When an entity at one end of an SSL channel receives a certificate from a remote connection, the entity asks The ACP if there is a user ID associated with that certificate. The entity uses that user ID as the channel user ID. If there is no user ID associated with the certificate, the entity uses the user ID under which the channel initiator is running. Without a validly defined Certificate Name Filter for the entity IBM WebSphere MQ will set the channel user ID to the default.","checkContent":"Validate that the list of all Production WebSphere MQ Remotes exists and contains approved Certified Name Filters and associated USERIDS.\n\nIf the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding. \n\nIf there is no Certificate Name Filter for WebSphere MQ Remotes this is a Finding.\n\nNote: Improper use of CNF filters for MQ Series will result in the following Message ID.\n\nCSQX632I found in the following example:\n\nCSQX632I csect-name SSL certificate has no\nassociated user ID, remote channel\nchannel-name - channel initiator user ID\nused","fixText":"The responsible MQ System programmer(s) shall create and maintain a spread sheet that contains a list of all Production WebSphere MQ Remotes, associated individual USERIDs with corresponding valid Certified Name Filters (CNF). This documentation will be reviewed and validated annually by responsible MQ System programmer(s) and forwarded for approval by the ISSM.\n\nThe ISSO will define the associated USERIDs, the CNF, and grant the minimal need to know access, by granting only the required resources and Commands for each USERID in the ACP. See IBM WebSphere MQ Security manual for details on defining CNF for WebSphere MQ.\n\nGeneric access shall not be granted such as resource permission at the SSID. MQ resource level.","ccis":["CCI-001133","CCI-000366"]},{"vulnId":"V-224554","ruleId":"SV-224554r1145047_rule","severity":"medium","ruleTitle":"User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements.","description":"Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nAutomated Analysis\nRefer to the following report produced by the z/OS Data Collection:\n\n- PDI(ZWMQ0020)\n\nReview the ssid report(s) and perform the following steps:\n\nFind the DISPLAY SECURITY command to locate the start of the security parameter settings.\nReview the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively.\nRepeat these steps for each queue manager ssid.\n\nThe standard values are:\n\nTIMEOUT(15)\nINTERVAL(5)\n\nIf the Timeout and Interval values conform to the standard values, this is not a finding.","fixText":"Review the WebSphere MQ System Setup Guide and the information on the ALTER SECURITY command in the WebSphere MQ Script (MQSC) Command Reference.\n\nEnsure the values for the TIMEOUT and INTERVAL parameters are specified in accordance with security requirements.","ccis":["CCI-000057","CCI-001133"]},{"vulnId":"V-224555","ruleId":"SV-224555r1145050_rule","severity":"medium","ruleTitle":"WebSphere MQ started tasks are not defined in accordance with the proper security requirements.","description":"Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- DSMON.RPT(RACSPT)\n- RACFCMDS.RPT(LISTUSER)\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nProvide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.\n\nssidMSTR is the name of a queue manager STC.\nssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.\n\nReview WebSphere MQ started tasks and ensure the following items are in effect, this is not a finding.\n\nssidMSTR and ssidCHIN started tasks are associated with a unique userid.\nssidMSTR and ssidCHIN started tasks userids are defined with the attribute of PROTECTED.\nssidMSTR and ssidCHIN started tasks are defined to the STARTED resource class.\nRepeat these steps for each queue manager ssid.","fixText":"Each queue manager started task procedure xxxxMSTR and distributed queuing started task procedure xxxxCHIN will have a matching profile defined to the STARTED resource class. Create a corresponding userid for each started task. The STC userids will be defined as PROTECTED userids. Queue manager and channel initiator started tasks will not be defined with the TRUSTED attribute.\n\nThe following sample contains commands to properly define the required Started Procs:\n\nNote that this example uses \"qmq1\" as the value for ssid.\n\nAU qmq1mstr NAME('STC, MQSERIES') NOPASS DFLTGRP(STC) OWNER(STC) DATA('MQSERIES QUEUE MANAGER PROC')      \n                \nAU qmq1chin NAME('STC, MQSERIES') NOPASSDFLTGRP(STC) OWNER(STC) DATA('MQSERIES DISTRIBUTED QUEUING CHANNEL INIT PROC')   \n\nRDEF STARTED qmq1mstr.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1mstr USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))\n\nRDEF STARTED qmq1chin.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1chin USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))\n\nSETR RACL(STARTED) REFRESH","ccis":["CCI-000764"]},{"vulnId":"V-224556","ruleId":"SV-224556r1145053_rule","severity":"medium","ruleTitle":"WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted.","description":"MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the ACP Data Collection:\n\n- SENSITVE.RPT(MQSRPT)\n\nVerify ACP data sets rules for WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows. If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nIf the following guidance is true, this is not a finding.\n\nThe ACP data set rules for the data sets restricts READ access to data sets referenced by the following DDnames is restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All access to these data sets is logged.\n\nDDname\tProcedure\tDescription\nCSQINP1\tssidMSTR\tInput parameters\nCSQINP2\tssidMSTR\tInput parameters\nCSQXLIB\tssidCHIN\tUser exit library\n\nThe ACP data set rules for the data sets restricts WRITE and/or greater access to the above data sets is restricted to WebSphere MQ administrators and systems programming personnel.\n\nThe ACP data set rules for the data sets restricts WRITE and/or greater access to data sets referenced by the following DDnames, restricted to WebSphere MQ STCs, WebSphere MQ administrators, and systems programming personnel. All WRITE and/or greater access to these data sets is logged.\n\nDDname\tProcedure\tDescription\nCSQPxxxx\tssidMSTR\tPage data sets\nBSDSx\tssidMSTR\tBootstrap data sets\nCSQOUTx\tssidMSTR\tSYSOUT data sets\nCSQSNAP\tssidMSTR\tDUMP data set\n(See note)\tssidMSTR\tLog data sets\n\nNote: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain data set names.\n \nThe ACP data set rules for the data sets restricts ALTER access to archive data sets is restricted to WebSphere MQ STCs, WebSphere MQ administrator, and systems programming personnel. All ALTER access to these data sets is logged.\n\nNote: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 data set high level qualifiers.\n\nExcept for the specific data set requirements just mentioned, WRITE and/or greater access to all other WebSphere MQ system data sets is restricted to the WebSphere MQ administrator and systems programming personnel.","fixText":"The systems programmer will have the ISSO ensure that all WRITE and/or greater access to WebSphere MQ product and system data sets is restricted to WebSphere MQ administrators, systems programmers, and WebSphere MQ started tasks.\n\nThe installation requires that the following data sets be APF authorized. \n\nhlqual.SCSQAUTH\nhlqual.SCSQLINK\nhlqual.SCSQANLx\nhlqual.SCSQSNL\nhlqual.SCSQMVR1\nhlqual.SCSQMVR2\n\nREAD access to data sets referenced by the CSQINP1, CSQINP2, and CSQXLIB DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all access to these data sets.\n\nWRITE and/or greater access to data set profiles protecting all page sets, logs, bootstrap data sets (BSDS), and data sets referenced by the CSQOUTX and CSQSNAP DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all WRITE and/or greater access to these data sets.\n\nALTER access to all archive data sets in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all ALTER access to these data sets.","ccis":["CCI-001499","CCI-002234"]},{"vulnId":"V-224557","ruleId":"SV-224557r1145056_rule","severity":"medium","ruleTitle":"WebSphere MQ resource classes must be properly activated for security checking by the ESM.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- RACFCMDS.RPT(SETROPTS)\n- DSMON.RPT(RACCDT) - Alternate list of active resource classes\n\nAutomated Analysis\nRefer to the following report produced by the RACF Data Collection:\n\n- PDI(ZWMQ0049)\n\nVerify the following WebSphere MQ resource classes are active, this is not a finding.\n\nGMQADMIN\nGMQNLIST\nGMQPROC\nGMQQUEUE\nMQADMIN\nMQCMDS\nMQCONN\nMQNLIST\nMQPROC\nMQQUEUE\n\nIf SCYCASE is set to MIXED, ensure the following WebSphere MQ resource classes are active, this is not a finding.\n\nGMXADMIN\nGMXNLIST\nGMXPROC\nGMXQUEUE\nGMXTOPIC\nMXADMIN\nMXNLIST\nMXPROC\nMXQUEUE\nMXTOPIC\n\nNote: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.","fixText":"Ensure that all WebSphere MQ resources are active and properly defined.\n\nEnsure the following WebSphere MQ resource classes are active:\n\nGMQADMIN\nGMQNLIST\nGMQPROC\nGMQQUEUE\nMQADMIN\nMQCMDS\nMQCONN\nMQNLIST\nMQPROC\nMQQUEUE\n\nWhen SCYCASE is set to mixed, CLASMAP Definitions must include the following entries:\n\nGMXADMIN\nGMXNLIST\nGMXPROC\nGMXQUEUE\nGMXTOPIC\nMXADMIN\nMXNLIST\nMXPROC\nMXQUEUE\nMXTOPIC\n\nNote: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.\n\nThe following sample contains commands to activate the required classes:\n\nSETR CLASSACT(MQADMIN MQCMDS MQCONN)\nSETR CLASSACT(MQNLIST MQPROC MQQUEUE)\nSETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)","ccis":["CCI-000213","CCI-002358"]},{"vulnId":"V-224558","ruleId":"SV-224558r1145059_rule","severity":"high","ruleTitle":"WebSphere MQ switch profiles must be properly defined to the appropriate ADMIN class.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nAutomated Analysis requires Additional Analysis.\nRefer to the following report produced by the z/OS Data Collection:\n\n- PDI(ZWMQ0051)\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nReview the Security switches identified in response to the DISPLAY SECURITY command in each ssid report(s). If all of the following switches specify ON, this is not a finding.\n\nSUBSYSTEM\nCONNECTION\nCOMMAND\nCONTEXT\nALTERNATE USER\nPROCESS\nNAMELIST\nQUEUE\nTOPIC\nCOMMAND RESOURCES\n\nIf SUBSYSTEM specifies OFF, this is a finding with a severity of Category I.\n\nIf any of the other above switches specify OFF (other than the exception mentioned below), this is a finding and downgrade the severity to a Category II.\n\nIf COMMAND RESOURCE Security switch specifies OFF, this is not a finding.\n\nNote: At the discretion of the ISSO, COMMAND RESOURCE Security switch may specify OFF by defining ssid.NO.CMD.RESC.CHECKS in the MQADMIN (or MXADMIN if SCYCASE is set to MIXED) resource class.","fixText":"Ensure all switch profiles are special WebSphere MQ profiles that are used to turn on/off security checking for a type of resource. Due to the security exposure this creates, no profiles with the first two qualifiers of ssid.NO will be defined to the MQADMIN or MXADMIN class, with one exception. Due to the fact that (1) all sensitive WebSphere MQ commands are restricted to queue managers, channel initiators, and designated systems personnel, and (2) no command resource checking is performed on DISPLAY commands, at the discretion of the ISSO, a ssid.NO.CMD.RESC.CHECKS switch profile may be defined to the MQADMIN or MXADMIN class.\n\nIdentify if any switch profiles exist using the sample search command:\n\nSR CLASS(MQADMIN) NOMASK FILTER(*.NO.**)\n\nUse the \"RDEL MQADMIN <SwitchProfileName>\" to remove the profile and follow up with a \"SETR RACL(MQADMIN) REF\".\n\nAn additional refresh to an active WebSphere MQ queue manager may be required. A sample is shown below using the value QMD1 as the queue manager name.\n\nFrom the Console:\n\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213"]},{"vulnId":"V-224559","ruleId":"SV-224559r1145062_rule","severity":"medium","ruleTitle":"WebSphere MQ connection class resource definitions must be protected in accordance with security.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- SENSITVE.RPT(MQCONN)\n\nReview the following connection resources for each queue manager defined to the connection resource class:\n\nResource\tAuthorized Users\nssid.BATCH\tTSO and batch job userids\nssid.CICS\tCICS region userids\nssid.IMS\tIMS region userids\nssid.CHIN\tChannel initiator userids\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nFor all connection resources defined to the MQCONN. If the following guidance is true, this is not a finding.\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization to these connections restricts access to the appropriate users as indicated above.\nAll access FAILUREs are logged.","fixText":"Review the following connection resources defined to the MQCONN resource class:\n\nResource\tAuthorized Users\nssid.BATCH\tTSO and batch job userids\nssid.CICS\tCICS region userids\nssid.IMS\tIMS region userids\nssid.CHIN\tChannel initiator userids\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nFor all connection resources defined to the MQCONN resource class, ensure the following items are in effect:\n\nNote: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, WebSphere MQ denies access.\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization to these connections restricts access to the appropriate users as indicated above.\nAll access FAILUREs are logged.\n\nA set of sample commands is provided below to implement the minimum profiles necessary for proper security. Note that the IMS and/or CICS profiles can be omitted if those products do not run on the target system.\n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQCONN ** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE')\n\nRDEF MQCONN <ssid>.BATCH UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READAUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052')\nPE <ssid>.BATCH CL(MQCONN) ID(<applicableTSO&batchUsers>)\n\nRDEF MQCONN <ssid>.CICS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052')\nPE <ssid>.CICS CL(MQCONN) ID(<CICSRegionUserids>)\n\nRDEF MQCONN <ssid>.IMS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052')\nPE <ssid>.IMS CL(MQCONN) ID(<IMSRegionUserids>)\n\nRDEF MQCONN <ssid>.CHIN UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052')\nPE <ssid>.CHIN CL(MQCONN) ID(<WebsphereMQCHINUsrids>)\n\nSETR RACL(MQCONN) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager Named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213"]},{"vulnId":"V-224560","ruleId":"SV-224560r1145065_rule","severity":"medium","ruleTitle":"WebSphere MQ dead letter and alias dead letter queues are not properly defined.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nReview the ssid report(s) and perform the following steps:\n\nFind the DISPLAY QMGR DEADQ command to locate the start of the dead-letter queue information. Review the DEADQ parameter to obtain the name of the real dead-letter queue.\n\nFrom the top of the report, find the QUEUE(dead-letter.queue.name) entry to locate the start of the real dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to the specified security requirements. If the following values are set for the dead-letter.queue.name, this is not a finding.\n\nThe  standard values are:\n\nGET(ENABLED)\nPUT(ENABLED)\n\nNote: dead-letter.queue.name is the value of the DEADQ parameter determined above.\n \nFrom the top of the report, find the QUEUE(dead-letter.queue.name.PUT) entry to locate the start of the alias dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to those specified in the security requirements. If the following values are set for the dead-letter.queue.name.PUT, this is not a finding.\n\nThe standard values are:\n\nGET(DISABLED)\nPUT(ENABLED)\n\nNote: Dead-letter.queue.name is the value of the DEADQ parameter determined above.\n\nNote: The TARGQ parameter value for the alias queue will be the real dead letter queue name.\n\nNote: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue must be coded to restrict unauthorized users and systems from reading the messages on the file.","fixText":"The systems programmer responsible for supporting WebSphere MQ will ensure that the dead-letter queue and its alias are properly defined.\n\nThe following scenario describes how to securely define a dead-letter queue:\n\nDefine the real dead-letter queue with attributes PUT(ENABLED) and GET(ENABLED).\n\nGive update authority for the dead-letter queue to CKTI (the WebSphere MQ-supplied CICS task initiator), channel initiators, and any automated application used for dead-letter queue maintenance.\n\nDefine an alias queue that resolves to the real dead-letter queue, but give the alias queue the attributes PUT(ENABLED) and GET(DISABLED).\n\nTo put a message on the dead-letter queue, an application uses the alias queue. The application does the following:\n\nRetrieve the name of the real dead-letter queue. To do this, it opens the queue manager object using MQOPEN, and then issues an MQINQ to get the dead-letter queue name.\n\nBuild the name of the alias queue by appending the characters \".PUT\" to this name, in this case, ssid.DEAD.QUEUE.PUT.\n\nOpen the alias queue, ssid.DEAD.QUEUE.PUT.\nPut the message on the real dead-letter queue by issuing an MQPUT against the alias queue.\nGive the userid associated with the application update authority to the alias, but no access to the real dead-letter queue.\n\nNote: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue will be coded to restrict unauthorized users and systems from reading the messages on the file.\n\nUndeliverable messages can be routed to a dead-letter queue. Two levels of access should be established for these queues. The first level allows applications, as well as some WebSphere MQ objects, to put messages to this queue. The second level restricts the ability to get messages from this queue and protects sensitive data. This will be accomplished by defining an alias queue that resolves to the real dead-letter queue, but defines the alias queue with the attributes PUT(ENABLED) and GET(DISABLED). The ability to get messages from the dead-letter queue will be restricted to message channel agents (MCAs), CKTI (WebSphere MQ-supplied CICS task initiator), channel initiators utility, and any automated application used for dead-letter queue maintenance.","ccis":["CCI-000764","CCI-001762"]},{"vulnId":"V-224561","ruleId":"SV-224561r1145295_rule","severity":"medium","ruleTitle":"WebSphere MQ MQQUEUE (Queue) resource profiles defined to the appropriate class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid).\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier). \n\nRefer to the following reports produced by the Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQQUEUE).\n- SENSITVE.RPT(MXQUEUE).\n\nFor all queues identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. Verify these queue resources are defined to the MQQUEUE and GMQQUEUE resource classes (or MXQUEUE and GMXQUEUE resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nResource profiles are defined with a UACC(NONE).\n\nFor message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nFor system queues (i.e., ssid.SYSTEM.queuename), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications.\n\nFor the following system queues, verify that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, auditors, and users that require access to review message queues:\nssid.SYSTEM.COMMAND.INPUT\nssid.SYSTEM.COMMAND.REPLY\nssid.SYSTEM.CSQOREXX.*\n\nFor system queues (i.e., ssid.SYSTEM.CSQUTIL.*), verify that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, and auditors.\n\nFor the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance.\n\nFor the alias dead-letter queue (to determine queue name, refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"For all queue resources defined to the MQQUEUE, GMQQUEUE, MXQUEUE, or GMXQUEUE resource classes, ensure the following items are in effect:\n\nFor all queues identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. Ensure these queue resources are defined to the MQQUEUE or GMQQUEUE resource classes. If the following guidance is true, this is not a finding.\n\nResource profiles are defined with a UACC(NONE).\n\nFor message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Decentralized MQ administrators, non-DECC datacenter users, can have up to ALTER access to the user Message Queues.\n\nFor system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts UPDATE and/or ALTER access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications.\n\nFor the following system queues, ensure that UPDATE access is restricted to auditors and users that require access to review message queues.\nssid.SYSTEM.COMMAND.INPUT\nssid.SYSTEM.COMMAND.REPLY\nssid.SYSTEM.CSQOREXX.*\nssid.SYSTEM.CSQUTIL.*\n\nFor the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance.\n\nFor the alias dead-letter queue (to determine queue name, refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nExample:\n\nRDEF MQQUEUE <ssid>.SYSTEM.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054')\nPE <ssid>.SYSTEM.** CL(MQQUEUE) ID(<RestrictedUsersAsSpecifiecAbove>)\n\nRDEF MQQUEUE <ssid>.<qname>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054')\nPE <ssid>.<qname> CL(MQQUEUE) ID(<AsSpecifiedAbove>)\n\nRDEF MQQUEUE <ssid>.<RealDeadLetterQue>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054')\nPE <ssid>.<RealDeadLetterQue> CL(MQQUEUE) ID(<AsSpecifiedAbove>)\n\nRDEF MQQUEUE <ssid>.<AliasDeadLetterQue>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054')\nPE <ssid>.<AliasDeadLetterQue> CL(MQQUEUE) ID(<AsSpecifiedAbove>)\n\nSETR RACL(MQQUEUE) REF","ccis":["CCI-000213"]},{"vulnId":"V-224562","ruleId":"SV-224562r1145297_rule","severity":"medium","ruleTitle":"WebSphere MQ Process resource profiles defined in the appropriate Class must be protected in accordance with security requirements.","description":"WebSphere MQ Process resources allow for the control of processes. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- SENSITVE.RPT(MQPROC).\n- SENSITVE.RPT(MXPROC).\n\nFor all process resources (i.e., ssid.processname) defined to the MQPROC and GMQPROC resource classes (or MXPROC and GMXPROC resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to make process inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"Process security validates userids authorized to issue WebSphere MQ inquiries on process definitions. A process definition object defines an application that is started in response to a trigger event on a queue manager. Process security will be active, and all profiles ssid.processname will be defined to the appropriate class. Restrict READ access to those userids requiring access to make process inquiries.\n\nFor all process resources (i.e., ssid.processname) defined to the MQPROC, GMQPROC, MXPROC, and GMXPROC resource classes, ensure the following items are in effect:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to make process inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nA set of sample commands are provided below to implement the minimum profiles necessary for proper security. \n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQPROC ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQPROC DENY-BY-DEFAULT PROFILE')\n\nRDEF MQPROC <ssid>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED FOR ZWMQ0055')\nPE <ssid>.** CL(MQPROC) ID(<ApplicableUsers>)\n\nSETR RACL(MQPROC) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)\n\nThe following is a sample of the commands required to allow a group (GRP1) to inquire on processes beginning with the letter V on queue manager (QM1):\n\nRDEFINE MQPROC QM1.V* UACC(NONE) AUDIT(ALL(READ))\nPERMIT QM1.V* CLASS(MQPROC) ID(GRP1) ACCESS(READ)","ccis":["CCI-000213"]},{"vulnId":"V-224563","ruleId":"SV-224563r1145074_rule","severity":"medium","ruleTitle":"WebSphere MQ Namelist resource profiles defined in the appropriate class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- SENSITVE.RPT(MQNLIST).\n- SENSITVE.RPT(MXNLIST).\n\nFor all namelist resources (i.e., ssid.namelist) defined to the MQNLIST and GMQNLIST resource class (or MXNLIST and GMXNLIST resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to make namelist inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"A namelist is a WebSphere MQ object that contains a list of queue names. Namelist security validates userids authorized to inquire on namelists. Namelist security will be active, and all profiles ssid.namelist will be defined to the MQNLIST, GMQNLIST, MXNLIST, or GMXNLIST classes with UACC(NONE) specified. Restrict READ access to those userids requiring access to make namelist inquiries.\n\nFor all namelist resources (i.e., ssid.namelist) defined to the MQNLIST, GMQNLIST, MXNLIST, or GMXNLIST resource classes, ensure the following items are in effect:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to make namelist inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nA set of sample commands are provided below to implement the minimum profiles necessary for proper security. \n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQNLIST ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE')\n\nRDEF MQNLIST <ssid>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED FOR ZWMQ0056')\nPE <ssid>.** CL(MQNLIST) ID(<applicable>)\n\nSETR RACL(MQNLIST) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213"]},{"vulnId":"V-224564","ruleId":"SV-224564r1145077_rule","severity":"medium","ruleTitle":"WebSphere MQ Alternate User resources defined to appropriate ADMIN resource class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- SENSITVE.RPT(MQADMIN).\n- SENSITVE.RPT(MXADMIN).\n\nFor all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"Alternate userid security allows access to be requested under another userid. Alternate userid security will be active, and all profiles ssid.ALTERNATE.USER.alternateuserid will be defined to the MQADMIN or MXADMIN class with UACC(NONE) specified. Restrict UPDATE access to those userids requiring access to alternate userids.\n\nFor all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to the MQADMIN or MXADMIN resource class, ensure the following items are in effect:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nA set of sample commands are provided below to implement the minimum profiles necessary for proper security. \n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQADMIN ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT PROFILE')\n\nRDEF MQADMIN <ssid>.ALTERNATE.USER.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT for ALT USER PROFILE')\n\nThe following is a sample of the commands required to allow payroll server (PAYSRV1) to specify alternate userids starting with the characters PS on queue manager (QM1):\n\nRDEFINE MQADMIN QMD1.ALTERNATE.USER.PS* UACC(NONE) AUDIT(ALL)\n\nPERMIT QMD1.ALTERNATE.USER.PS* CLASS(MQADMIN) ID(PAYSRV1) ACCESS(UPDATE)\n\nSETR RACL(MQADMIN) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213"]},{"vulnId":"V-224565","ruleId":"SV-224565r1145080_rule","severity":"medium","ruleTitle":"WebSphere MQ context resources defined to the appropriate ADMIN resource class must be protected in accordance with security requirements.","description":"Context security validates whether a userid has authority to pass or set identity and/or origin data for a message. Context security will be active to avoid security exposure.\n\nThis exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the RACF Data Collection:\n\n- SENSITVE.RPT(MQADMIN).\n- SENSITVE.RPT(MXADMIN).\n\nFor all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"Context security validates whether a userid has authority to pass or set identity and/or origin data for a message. Context security will be active, and all profiles ssid.CONTEXT will be defined to the appropriate ADMIN class with UACC(NONE) specified, where ssid is the queue manager name.\n\nREAD access is required when the PASS option is specified for an MQOPEN or MQPUT1. Update or control access is required when the SET or OUTPUT option is specified.\n\nFor all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN or MXADMIN resource class, ensure the following items are in effect:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nA set of sample commands are provided below to implement the minimum profiles necessary for proper security. \n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQADMIN ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT PROFILE')\n\nRDEF MQADMIN <ssid>.CONTEXT UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN PROFILE REQUIRED FOR CONTEXT SECURITY')\n\nThe following is a sample of the commands required to allow a systems programming group (SYS1) to offload and reload messages for queue manager (QMD1):\n\nPERMIT QMD1.CONTEXT CLASS(MQADMIN) ID(SYS1) ACCESS(CONTROL)\n\nThe following refresh is required for RACListed classes:\n\nSETR RACL(MQADMIN) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213"]},{"vulnId":"V-224566","ruleId":"SV-224566r1145299_rule","severity":"medium","ruleTitle":"WebSphere MQ command resources defined to MQCMDS resource class are not protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of  commands. Failure to properly protect WebSphere MQ Command resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following reports produced by the Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQCMDS).\n\nFor all command resources (i.e., ssid.command) defined to the MQCMDS and GMQCMDS resource classes. If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to the appropriate personnel as designated in the WebSphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.\nAll command access is logged as designated in the WebScphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.","fixText":"Command security validates userids authorized to issue MQSeries/WebSphere MQ commands. Command security will be active\n\nFor all command resources (i.e., ssid.command) defined to the MQCMDS resource class, ensure the following items are in effect:\n\nNOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nResource profiles are defined with a UACC(NONE).\nAccess authorization restricts access to the appropriate personnel as designated in the table titled \"Websphere MQ Command Security Controls\" in the zOS STIG Addendum.\nAll command access is logged as designated in the table titled \"Websphere MQ Command Security Controls\" in the zOS STIG Addendum.\n\nA set of sample commands are provided below to implement the minimum profiles necessary for proper security. \n\n/* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */\nRDEF MQCMDS ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCMDS DENY-BY-DEFAULT PROFILE')\n\nRDEF MQCMDSN <ssid>.<CmdName>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCMDS Required See ZWMQ0059')\n\nPE <ssid>.<CmdNAme>.** CL(MQCMDS) ID(<authorizeduser>) ACC(C)\n\nSETR RACL(MQCMDS) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active Qmanagers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-000213","CCI-002234"]},{"vulnId":"V-224567","ruleId":"SV-224567r1145086_rule","severity":"medium","ruleTitle":"WebSphere MQ RESLEVEL resources in the appropriate ADMIN resource class must be protected in accordance with security requirements.","description":"RESLEVEL security profiles control the number of userids checked for API-resource security. RESLEVEL is a powerful option that can cause the bypassing of all security checks. RESLEVEL security will not be implemented.","checkContent":"Refer to the following reports produced by the Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQADMIN).\n- SENSITVE.RPT(MXADMIN).\n\nAutomated Analysis\nRefer to the following report produced by the Data Set and Resource Data Collection:\n\n- PDI(ZWMQ0060).\n\nReview the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classes, if SCYCASE is set to MIXED). If the following guidance is true, this is not a finding.\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nA RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager with a UACC(NONE).\nAccess authorization to these RESLEVEL resources restricts all access. No users or groups must be specified in the access list.","fixText":"RESLEVEL security profiles control the number of userids checked for API-resource security. RESLEVEL security will not be implemented due to the following exposures and limitations:\nRESLEVEL is a powerful option that can cause the bypassing of all security checks.\nSecurity audit records are not created when the RESLEVEL profile is utilized.\nIf the WARNING option is specified on a RESLEVEL profile, no warning messages are produced.\n\nTo protect against any profile in the MQADMIN or MXADMIN class, such as ssid.**, resolving to a RESLEVEL profile, a ssid.RESLEVEL profile will be defined for each queue manager with UACC(NONE) specified and no users or groups specified in the access list.\n\nEnsure the following items are in effect:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nA RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to the MQADMIN  or MXADMIN resource class with a UACC(NONE).\nAccess authorization to these RESLEVEL resources restricts all access. No users or groups must be specified in the access list.\n\nA set of sample commands is provided below to implement the profile necessary for proper security. \n\nRDEF MQADMIN <ssid>.RESLEVEL UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN PROFILE REQUIRED BY ZWMQ0060')\n\nSETR RACL(MQADMIN) REF\n\nNote that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE:\n\nThe example is for a queue manager named QMD1:\n>QMD1 REFRESH SECURITY(*)","ccis":["CCI-001762","CCI-000213"]}]}