STIGQter: STIG Summary: z/OS CL/SuperSession for RACF Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

CL/SuperSession KLVINNAM member must be configured in accordance with security requirements.

DISA Rule

SV-224468r1144739_rule

Vulnerability Number

V-224468

Group Title

SRG-OS-000018

Rule Version

ZCLSR042

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Ensure that the parameter options for member KLKINNAM for version 3 of CL/Supersession or KLVINNAM for version 2 of CL/SuperSession are coded to the below specifications.

(Note: The data set identified below is an example of a possible installation. The actual data set is determined when the product is actually installed on a system through the product's installation guide and can be site specific.)

Review the member KLKINNAM or KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Ensure all session manager security parameters and control options are in compliance according to the following:

DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
RACF -
CLASSES=APPCLASS -
NODB
EXIT=KLVRACVR

(The following is for z/OS CAC logon processing)
DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
SAF - (RACF is also acceptable) CLASSES=APPCLASS -
NODB -
EXIT=KLSNFPTX

Check Contents

Version 3 of CL/SuperSession
Review the member KLKINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Version 2 of CL/SuperSession
Review the member KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZCLS0042).

If one of the following configuration settings is specified for each control point defined in the KLKINNAM member for version 3 of CL/SuperSession or KLVINNAM member for version 2 of CL/SuperSession, this is not a finding.

DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
RACF -
CLASSES=APPCLASS -
NODB
EXIT=KLVRACVR

(The following is for z/OS CAC logon processing)
DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
SAF - (RACF is also acceptable)
CLASSES=APPCLASS -
NODB -
EXIT=KLSNFPTX

Vulnerability Number

V-224468

Documentable

False

Rule Version

ZCLSR042

Severity Override Guidance

Version 3 of CL/SuperSession
Review the member KLKINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Version 2 of CL/SuperSession
Review the member KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZCLS0042).

If one of the following configuration settings is specified for each control point defined in the KLKINNAM member for version 3 of CL/SuperSession or KLVINNAM member for version 2 of CL/SuperSession, this is not a finding.

DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
RACF -
CLASSES=APPCLASS -
NODB
EXIT=KLVRACVR

(The following is for z/OS CAC logon processing)
DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) -
SAF - (RACF is also acceptable)
CLASSES=APPCLASS -
NODB -
EXIT=KLSNFPTX

Check Content Reference

M

Target Key

4148