STIGQter: STIG Summary: zOS WebSphere MQ for RACF Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

WebSphere MQ started tasks are not defined in accordance with the proper security requirements.

DISA Rule

SV-224555r1145050_rule

Vulnerability Number

V-224555

Group Title

SRG-OS-000104

Rule Version

ZWMQ0030

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Each queue manager started task procedure xxxxMSTR and distributed queuing started task procedure xxxxCHIN will have a matching profile defined to the STARTED resource class. Create a corresponding userid for each started task. The STC userids will be defined as PROTECTED userids. Queue manager and channel initiator started tasks will not be defined with the TRUSTED attribute.

The following sample contains commands to properly define the required Started Procs:

Note that this example uses "qmq1" as the value for ssid.

AU qmq1mstr NAME('STC, MQSERIES') NOPASS DFLTGRP(STC) OWNER(STC) DATA('MQSERIES QUEUE MANAGER PROC')

AU qmq1chin NAME('STC, MQSERIES') NOPASSDFLTGRP(STC) OWNER(STC) DATA('MQSERIES DISTRIBUTED QUEUING CHANNEL INIT PROC')

RDEF STARTED qmq1mstr.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1mstr USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))

RDEF STARTED qmq1chin.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1chin USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))

SETR RACL(STARTED) REFRESH

Check Contents

Refer to the following reports produced by the RACF Data Collection:

- DSMON.RPT(RACSPT)
- RACFCMDS.RPT(LISTUSER)

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.

ssidMSTR is the name of a queue manager STC.
ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.

Review WebSphere MQ started tasks and ensure the following items are in effect, this is not a finding.

ssidMSTR and ssidCHIN started tasks are associated with a unique userid.
ssidMSTR and ssidCHIN started tasks userids are defined with the attribute of PROTECTED.
ssidMSTR and ssidCHIN started tasks are defined to the STARTED resource class.
Repeat these steps for each queue manager ssid.

Vulnerability Number

V-224555

Documentable

False

Rule Version

ZWMQ0030

Severity Override Guidance

Refer to the following reports produced by the RACF Data Collection:

- DSMON.RPT(RACSPT)
- RACFCMDS.RPT(LISTUSER)

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.

ssidMSTR is the name of a queue manager STC.
ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.

Review WebSphere MQ started tasks and ensure the following items are in effect, this is not a finding.

ssidMSTR and ssidCHIN started tasks are associated with a unique userid.
ssidMSTR and ssidCHIN started tasks userids are defined with the attribute of PROTECTED.
ssidMSTR and ssidCHIN started tasks are defined to the STARTED resource class.
Repeat these steps for each queue manager ssid.

Check Content Reference

M

Target Key

4167