STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM z/OS UNIX user accounts must be properly defined.

DISA Rule

SV-223635r1225856_rule

Vulnerability Number

V-223635

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

ACF2-US-000200

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Define users of z/OS UNIX (i.e., users with an OMVS profile defined) as follows:

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Contents

From an ACF Command screen enter:

SET PROFILE(USER) DIV(OMVS)

LI LIKE(-)

If each user account is defined as follows, this is not a finding.

A unique UID number (except for UID(0) users)

Use the following as a quick test for duplicate UIDs apart from UID 0

SHOW OMVS USERS(1-2147483647) DUPLICATES

-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Vulnerability Number

V-223635

Documentable

False

Rule Version

ACF2-US-000200

Severity Override Guidance

From an ACF Command screen enter:

SET PROFILE(USER) DIV(OMVS)

LI LIKE(-)

If each user account is defined as follows, this is not a finding.

A unique UID number (except for UID(0) users)

Use the following as a quick test for duplicate UIDs apart from UID 0

SHOW OMVS USERS(1-2147483647) DUPLICATES

-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Content Reference

M

Target Key

4100