STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

IBM z/OS Syslog daemon must be properly defined and secured.

DISA Rule

SV-223592r533198_rule

Vulnerability Number

V-223592

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

ACF2-SL-000030

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Define the Syslog daemon logonid as SYSLOGD with the STC attribute.

To set up and use as an MVS Started Proc, the following sample commands are provided:
SET LID
INSERT SYSLOGD NAME(SYSLOGD STC) GROUP(stctcpx) STC

The SYSLOGD userid has UID(0), HOME('/'), and PROGRAM('/bin/sh') specified in the OMVS segment.

SET PROFILE(USER) DIVISION(OMVS)
INSERT SYSLOGD UID(0) HOME(/) PROGRAM(/bin/sh)

F ACF2,REBUILD(USR),CLASS(P)

If /etc/rc is used to start the Syslog daemon ensure that the _BPX_JOBNAME and _BPX_ USERID environment variables are assigned a value of SYSLOGD.

Check Contents

The syslog daemon is defined as SYSLOGD.

From the ACF command screen enter:
SET LID
LIST SYSLOGD

If the Syslog daemon is not defined, this is a finding.

If the SYSLOGD logonid is not defined with the STC attribute, this is a finding.

If the SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment, this is not a finding.

If Syslog daemon is started from /etc/rc then ensure that the _BPX_JOBNAME and _BPX_USERID environment variables are assigned a value of SYSLOGD.

Vulnerability Number

V-223592

Documentable

False

Rule Version

ACF2-SL-000030

Severity Override Guidance

The syslog daemon is defined as SYSLOGD.

From the ACF command screen enter:
SET LID
LIST SYSLOGD

If the Syslog daemon is not defined, this is a finding.

If the SYSLOGD logonid is not defined with the STC attribute, this is a finding.

If the SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment, this is not a finding.

If Syslog daemon is started from /etc/rc then ensure that the _BPX_JOBNAME and _BPX_USERID environment variables are assigned a value of SYSLOGD.

Check Content Reference

M

Target Key

4100

Comments