STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM z/OS UNIX user accounts must be properly defined.

DISA Rule

SV-224097r958482_rule

Vulnerability Number

V-224097

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

TSS0-US-000240

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Configure each user account to be defined as specified below:

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Contents

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

From the ISPF Command Shell enter:
TSS LIST(ACIDS) SEGMENT(OMVS)

If any user account is not defined as follows, this is a finding.

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Vulnerability Number

V-224097

Documentable

False

Rule Version

TSS0-US-000240

Severity Override Guidance

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

From the ISPF Command Shell enter:
TSS LIST(ACIDS) SEGMENT(OMVS)

If any user account is not defined as follows, this is a finding.

-A unique UID number (except for UID(0) users).
-A unique HOME directory (UID(0), other system task accounts, and tasks approved by the ISSM are excluded from this rule).
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false".

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default; this does not include tasks that are excluded from above).

Check Content Reference

M

Target Key

4102