STIGQter: STIG Summary: zOS WebSphere MQ for TSS Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 01 Jul 2026:

WebSphere MQ security class(es) must not be defined improperly.

DISA Rule

SV-225629r1146215_rule

Vulnerability Number

V-225629

Group Title

SRG-OS-000080

Rule Version

ZWMQ0049

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002358 - Implement a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

Ensure that all WebSphere MQ resources are defined to TSS.

The following should be defined to the RDT:

MQADMIN
MQCONN
MQCMDS
MQNLIST
MQPROC
MQQUEUE

When SCYCASE is set to mixed, and the following WebSphere MQ resource classes should be defined to the TSS RDT.

MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Use the following commands to define (establish ownership of) resources for each WebSphere MQ subsystem to TSS:

TSS ADD(deptname) MQADMIN(ssid.)
TSS ADD(deptname) MQCMDS(ssid.)
TSS ADD(deptname) MQCONN(ssid.)
TSS ADD(deptname) MQNLIST(ssid.)
TSS ADD(deptname) MQPROC(ssid.)
TSS ADD(deptname) MQQUEUE(ssid.)

When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries:

TSS ADD(deptname) MXADMIN(ssid.)
TSS ADD(deptname) MXNLIST(ssid.)
TSS ADD(deptname) MXPROC(ssid.)
TSS ADD(deptname) MXQUEUE(ssid.)
TSS ADD(deptname) MXTOPIC(ssid.)

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

Another method to ensure protection is to assign the DEFPROT attribute to the resource class in the RDT record by using the following command:

TSS REP(RDT) RESCLASS(MQADMIN) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MQCMDS) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MQCONN) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MQNLIST) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MQPROC) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MQQUEUE) ATTR(DEFPROT)

When SCYCASE is set to mixed.

TSS REP(RDT) RESCLASS(MXADMIN) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MXNLIST) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MXPROC) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MXQUEUE) ATTR(DEFPROT)
TSS REP(RDT) RESCLASS(MXTOPIC) ATTR(DEFPROT)

Check Contents

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(#RDT).
- SENSITVE.RPT(WHOOMADM).
- SENSITVE.RPT(WHOOMCMD).
- SENSITVE.RPT(WHOOMCON).
- SENSITVE.RPT(WHOOMNLI).
- SENSITVE.RPT(WHOOMPRO.)
- SENSITVE.RPT(WHOOMQUE).
- SENSITVE.RPT(WHOOXADM).
- SENSITVE.RPT(WHOOXNLI).
- SENSITVE.RPT(WHOOXPRO).
- SENSITVE.RPT(WHOOXQUE).
- SENSITVE.RPT(WHOOXTOP).

If the following WebSphere MQ Resource Class(es) is (are) defined in the Resource Definition Table (RDT), this is not a finding.

MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

When SCYCASE is set to MIXED, and the following WebSphere MQ Resource Class(es) is (are) defined in the Resource Definition Table (RDT), this is not a finding.

MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

Note: If both MQADMIN and MXADMIN resource classes are not defined to the RDT record, no security checking is performed.

Vulnerability Number

V-225629

Documentable

False

Rule Version

ZWMQ0049

Severity Override Guidance

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(#RDT).
- SENSITVE.RPT(WHOOMADM).
- SENSITVE.RPT(WHOOMCMD).
- SENSITVE.RPT(WHOOMCON).
- SENSITVE.RPT(WHOOMNLI).
- SENSITVE.RPT(WHOOMPRO.)
- SENSITVE.RPT(WHOOMQUE).
- SENSITVE.RPT(WHOOXADM).
- SENSITVE.RPT(WHOOXNLI).
- SENSITVE.RPT(WHOOXPRO).
- SENSITVE.RPT(WHOOXQUE).
- SENSITVE.RPT(WHOOXTOP).

If the following WebSphere MQ Resource Class(es) is (are) defined in the Resource Definition Table (RDT), this is not a finding.

MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

When SCYCASE is set to MIXED, and the following WebSphere MQ Resource Class(es) is (are) defined in the Resource Definition Table (RDT), this is not a finding.

MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

Note: ssid is the queue manager name (a.k.a., subsystem identifier).

Note: If both MQADMIN and MXADMIN resource classes are not defined to the RDT record, no security checking is performed.

Check Content Reference

M

Target Key

4211