From z/OS ACF2 STIG
Part of ITNT0010
Associated with IA controls: DCCS-1, DCCS-2
Associated with: CCI-000764
The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TN3270 Telnet Server. Several of these parameters have potential impact to system security. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.
a) Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL. Automated Analysis requires Additional Analysis. Refer to the following report produced by the IBM Communications Server Data Collection: - PDI(ITNT0010) b) Ensure the following items are in effect for the configuration statements specified in the TCP/IP Profile configuration file: NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well. TELNETGLOBAL Block (only one defined) 1) The KEYRING statement, if used, is only coded within the TELNETGLOBALS statement block. 2) The KEYRING statement, if used, specifies the SAF parameter. TELNETPARMS Block (one defined for each port the server is listening to, typically ports 23 and 992) 1) The TELNETPARMS INACTIVE statement is coded within each TELNETPARMS statement block and specifies a value between 1 and 900. NOTE: Effective in z/OS release 1.2, the INACTIVE statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks. 2) The TELNETPARMS TKOSPECLURECON statement is not coded or commented out. BEGINVTAM Block (one or more defined) 1) The BEGINVTAM RESTRICTAPPL statement is not be coded or commented out. c) If all of the above are true, there is NO FINDING. d) If any of the above is untrue, this is a FINDING.
Review the configuration statements in the PROFILE.TCPIP file and ensure they conform to the specifications below: NOTE: If the INCLUDE statement is coded in the TCP/IP Profile configuration file, the data set specified on this statement must be checked for the following items as well. The KEYRING statement, if used, is only coded within the TELNETGLOBALS statement block. The KEYRING statement, if used, specifies the SAF parameter. "TELNETPARMS Block (one defined for each port the server is listening to, typically ports 23 and 992) " The TELNETPARMS INACTIVE statement is coded within each TELNETPARMS statement block and specifies a value between 1 and 900. INACTIVE statements should not be coded with a value greater than 900 or 0. 0 disables the inactivity timer check. NOTE: Effective in z/OS release 1.2, the INACTIVE statement can appear in both TELNETGLOBAL and TELNETPARM statement blocks. The TELNETPARMS TKOSPECLURECON statement should not be coded or it should be commented out. BEGINVTAM Block (one or more defined) The BEGINVTAM RESTRICTAPPL statement is not be coded or it should be commented out.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer