STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM z/OS SSL encryption options for the TN3270 Telnet Server must be specified properly.

DISA Rule

SV-223831r1212325_rule

Vulnerability Number

V-223831

Group Title

SRG-OS-000033-GPOS-00014

Rule Version

RACF-TN-000020

Severity

CAT II

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002420 - Maintain the confidentiality and/or integrity of information during preparation for transmission.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure AT-TLS policy to define security parameters. The policy must include the FIPS 140-3 cipher suites specified below.

Cipher Specifications

The following suites are allowed for the TLS 1.3 protocol:
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384

The following suites are allowed for the TLS 1.2 protocol:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

Note: Always check for the minimum allowed in FIPS 140-3.

Check Contents

From the ISPF Command Shell, enter:
OMVS
Enter:
pasearch -t
to display all Application Transparent Transport Layer Security (AT-TLS) policy entries.

If the TTLS cipher suites entries do not contain the following cipher suites, this is a finding.

Note: FIPS 140-3 minimum encryption is the accepted level of encryption and will override this requirement if greater.

Cipher Specifications

The following suites are allowed for the TLS 1.3 protocol:
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384

The following suites are allowed for the TLS 1.2 protocol:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

Vulnerability Number

V-223831

Documentable

False

Rule Version

RACF-TN-000020

Severity Override Guidance

From the ISPF Command Shell, enter:
OMVS
Enter:
pasearch -t
to display all Application Transparent Transport Layer Security (AT-TLS) policy entries.

If the TTLS cipher suites entries do not contain the following cipher suites, this is a finding.

Note: FIPS 140-3 minimum encryption is the accepted level of encryption and will override this requirement if greater.

Cipher Specifications

The following suites are allowed for the TLS 1.3 protocol:
TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384

The following suites are allowed for the TLS 1.2 protocol:
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

Check Content Reference

M

Target Key

4101