STIGQter STIGQter: STIG Summary: z/OS RACF STIG Version: 6 Release: 43 Benchmark Date: 24 Jan 2020: HFS objects for the z/OS UNIX Telnet Server will be properly protected.

DISA Rule

SV-3232r3_rule

Vulnerability Number

V-3232

Group Title

IUTN0040

Rule Version

IUTN0040

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

The IAO with the assistance of a systems programmer with UID(0) and/or SUPERUSER access, will review the UNIX permission bits and user audit bits on the HFS directories and files for the z/OS UNIX Telnet Server. Ensure they conform to the specifications below:

z/OS UNIX TELNET Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/otelnetd 1740 fff
/etc/banner 0744 faf

NOTE:
The /usr/sbin/otelnetd object is a symbolic link to /usr/lpp/tcpip/sbin/otelnetd. The permission and user audit bits on the target of the symbolic link must have the required settings.

The following represents a hierarchy for permission bits from least restrictive to most restrictive:

7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)

The possible audit bits settings are as follows:

f log for failed access attempts
a log for failed and successful access
- no auditing

The following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:

chmod 1740 /usr/lpp/tcpip/sbin/otelnetd
chaudit rwx=f /usr/lpp/tcpip/sbin/otelnetd
chmod 0744 /etc/banner
chaudit w=sf,rx+f /etc/banner

Check Contents

Refer to the following report produced by the UNIX System Services Data Collection:

- USSCMDS.RPT(IUTN0040)

Refer to the following report produced by the IBM Communications Server Data Collection:

- PDI(ZUTN0040)

The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.

z/OS UNIX TELNET Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/otelnetd 1740 fff
/etc/banner 0744 faf

NOTE:
The /usr/sbin/otelnetd object is a symbolic link to /usr/lpp/tcpip/sbin/otelnetd. The permission and user audit bits on the target of the symbolic link must have the required settings.

The following represents a hierarchy for permission bits from least restrictive to most restrictive:

7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)

The possible audit bits settings are as follows:

f log for failed access attempts
a log for failed and successful access
- no auditing

Vulnerability Number

V-3232

Documentable

False

Rule Version

IUTN0040

Severity Override Guidance

Refer to the following report produced by the UNIX System Services Data Collection:

- USSCMDS.RPT(IUTN0040)

Refer to the following report produced by the IBM Communications Server Data Collection:

- PDI(ZUTN0040)

The HFS permission bits and user audit bits for each directory and file match or are more restrictive than the specified settings listed in the table. If the guidance is true, this is not a finding.

z/OS UNIX TELNET Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/otelnetd 1740 fff
/etc/banner 0744 faf

NOTE:
The /usr/sbin/otelnetd object is a symbolic link to /usr/lpp/tcpip/sbin/otelnetd. The permission and user audit bits on the target of the symbolic link must have the required settings.

The following represents a hierarchy for permission bits from least restrictive to most restrictive:

7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)

The possible audit bits settings are as follows:

f log for failed access attempts
a log for failed and successful access
- no auditing

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

106

Comments