STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 8 Release: 3 Benchmark Date: 23 Apr 2021:

IBM z/OS UNIX user accounts must be properly defined.

DISA Rule

SV-223862r604139_rule

Vulnerability Number

V-223862

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

RACF-US-000250

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Define users of z/OS UNIX (i.e., users with an OMVS profile defined) as follows:

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as “/bin/sh”, “/bin/tcsh”, “/bin/echo”, or “/bin/false”

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Check Contents

From a z/OS command screen enter:
LISTUSER * OMVS NORACF

NOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

If each user account with an OMVS segment is defined as follows, this is not a finding.

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as “/bin/sh”, “/bin/tcsh”, “/bin/echo”, or “/bin/false”

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Vulnerability Number

V-223862

Documentable

False

Rule Version

RACF-US-000250

Severity Override Guidance

From a z/OS command screen enter:
LISTUSER * OMVS NORACF

NOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

If each user account with an OMVS segment is defined as follows, this is not a finding.

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as “/bin/sh”, “/bin/tcsh”, “/bin/echo”, or “/bin/false”

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Check Content Reference

M

Target Key

4101

Comments