STIGQter STIGQter: STIG Summary: z/OS RACF STIG Version: 6 Release: 43 Benchmark Date: 24 Jan 2020: CONSOLxx members must be properly configured.

DISA Rule

SV-7923r4_rule

Vulnerability Number

V-7485

Group Title

ACP00291

Rule Version

ACP00291

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure that the "DEFAULT" statement specifies "LOGON(REQUIRED)" so that all operators are required to log on prior to entering z/OS system commands. At the discretion of the ISSO, "LOGON(AUTO)" may be used. If "LOGON(AUTO)" is used assure that the console userids are defined with minimal access. See ACP00292.

Ensure that each "CONSOLE" statement specifies an explicit console NAME. And that "AUTH(INFO)" is specified, this also including extended MCS consoles. "AUTH(MASTER)" may be specified for systems console.

Note: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the "DEFAULT" statement requirement.

Check Contents

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PARMLIB)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ACP00291)

Review each CONSOLxx parmlib member. If the following guidance is true, this is not a finding.

____ The "DEFAULT" statement for each CONSOLxx member specifies "LOGON(REQUIRED)" or "LOGON(AUTO)".

____ The "CONSOLE" statement for each console assigns a unique name using the "NAME" parameter.

____ The "CONSOLE" statement for each console specifies "AUTH(INFO)". Exceptions are the "AUTH" parameter is not valid for consoles defined with "UNIT(PRT)" and specifying "AUTH(MASTER)" is permissible for the system console.

Note: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the "DEFAULT" statement requirement.

Vulnerability Number

V-7485

Documentable

False

Rule Version

ACP00291

Severity Override Guidance

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PARMLIB)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ACP00291)

Review each CONSOLxx parmlib member. If the following guidance is true, this is not a finding.

____ The "DEFAULT" statement for each CONSOLxx member specifies "LOGON(REQUIRED)" or "LOGON(AUTO)".

____ The "CONSOLE" statement for each console assigns a unique name using the "NAME" parameter.

____ The "CONSOLE" statement for each console specifies "AUTH(INFO)". Exceptions are the "AUTH" parameter is not valid for consoles defined with "UNIT(PRT)" and specifying "AUTH(MASTER)" is permissible for the system console.

Note: The site should be able to determine the system consoles. However, it is imperative that the site adhere to the "DEFAULT" statement requirement.

Check Content Reference

M

Responsibility

Systems Programmer

Target Key

106

Comments