STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 9 Release: 9 Benchmark Date: 01 Jul 2026:

IBM z/OS started tasks for the Base TCP/IP component must be defined in accordance with security requirements.

DISA Rule

SV-272877r1130282_rule

Vulnerability Number

V-272877

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

RACF-TC-000065

Severity

CAT II

CCI(s)

• CCI-000764 - Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users.

Weight

10

Fix Recommendation

Develop a plan of action to implement the required changes. Ensure the following items are in effect for the ACID(s) assigned to the TCP/IP address space(s):

1) Named TCPIP or, in the case of multiple instances, prefixed with TCPIP.

2) Has the STC facility.

3) z/OS Unix attributes: UID(0), HOME directory '/', shell program /bin/sh.

Ensure the following items are in effect for the USERID assigned to the EZAZSSI started task:

1) Named EZAZSSI.

2) Has the STC facility.

For example:

The following commands can be used to create the user accounts and assign the privileges that are required for the TCP/IP address space and the EZAZSSI started task:

1) Define a userid for the TCPIP Address space. A sample command is shown here:

ADDUSER TCPIP NAME('STC, TCPIP') NOPASS DFLTGRP(STCTCPX) OWNER(STCTCPX) OMVS(UID(0) HOME('/') PROGRAM('/bin/sh'))

2) Define a matching entry in the STARTED Class. A sample command is shown here:

RDEFINE STARTED TCPIP.** UACC(NONE) OWNER(ADMN) AUDIT(ALL(READ)) STDATA(USER(TCPIP) GROUP(STCTCPX) TRACE(YES))

3) Set up the RACF userid for the EZAZSSI Proc. A sample command to accomplish this is shown here:

AU EZAZSSI NAME('STC, EZAZSSI') NOPASS OWNER(STCTCPX) DFLTGRP(STCTCPX)

4) Define a matching entry in the STARTED class for the EZAZSSI proc. A sample command to accomplish this is shown here:

RDEF STARTED EZAZSSI.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) STDATA(USER(EZAZSSI) GROUP(STCTCPX) TRACE(YES))

Check Contents

Refer to system Proclibs to determine the TCPIP address space(s).

From the ISPF Command Shell, enter:
LISTUSER<TCPIP STCs> OMVS

For each TCPIP:
-Named TCPIP or, in the case of multiple instances, prefixed with TCPIP.
-Has the STC facility.

-z/OS Unix attributes:
UID(0), HOME directory '/', shell program /bin/sh
If all of the following items are true, this is not a finding.

If any item is untrue, this is a finding.

From the ISPF Command Shell, enter:
LISTUSER EZAZSSI OMVS
If EZAZSSI STC has the STC facility, this is not finding.

Ensure the following items are in effect for the USERID assigned to the EZAZSSI started task:
-Named EZAZSSI.
-Has the STC facility.

Vulnerability Number

V-272877

Documentable

False

Rule Version

RACF-TC-000065

Severity Override Guidance

Refer to system Proclibs to determine the TCPIP address space(s).

From the ISPF Command Shell, enter:
LISTUSER<TCPIP STCs> OMVS

For each TCPIP:
-Named TCPIP or, in the case of multiple instances, prefixed with TCPIP.
-Has the STC facility.

-z/OS Unix attributes:
UID(0), HOME directory '/', shell program /bin/sh
If all of the following items are true, this is not a finding.

If any item is untrue, this is a finding.

From the ISPF Command Shell, enter:
LISTUSER EZAZSSI OMVS
If EZAZSSI STC has the STC facility, this is not finding.

Ensure the following items are in effect for the USERID assigned to the EZAZSSI started task:
-Named EZAZSSI.
-Has the STC facility.

Check Content Reference

M

Target Key

4101