STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM z/OS UNIX user accounts must be properly defined.

DISA Rule

SV-223862r958482_rule

Vulnerability Number

V-223862

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

RACF-US-000250

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Define users of z/OS UNIX (i.e., users with an OMVS profile defined) as follows:

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Contents

From a z/OS command screen enter:
LISTUSER * OMVS NORACF

NOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

If each user account with an OMVS segment is defined as follows, this is not a finding.

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Vulnerability Number

V-223862

Documentable

False

Rule Version

RACF-US-000250

Severity Override Guidance

From a z/OS command screen enter:
LISTUSER * OMVS NORACF

NOTE: This check only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

If each user account with an OMVS segment is defined as follows, this is not a finding.

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Content Reference

M

Target Key

4101