Batch job user Ids must be properly defined.

Associated with: CCI-000052 CCI-000724 CCI-000764 CCI-000804

SV-19114r3_rule Batch job user Ids must be properly defined.

Vulnerability discussion

Batch jobs are submitted to the operating system under their own USERID. This will identify the batch job with the user for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.

Check content

Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated user IDs. From a command input screen enter: LISTUSER(each identified batch job) Alternately: Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) The following USERID record fields/attributes must be specified: NAME PROTECTED No USERID has the LAST-ACCESS field set to UNKNOWN. If both of the above are true, this is not a finding. If either of the USERID record fields/attributes (NAME and/or PROTECTED) are blank and/or the LAST ACCESS field is set to unknown, this is a finding.

Fix text

Ensure the following: Associated USERIDs exist for all batch jobs and documentation authorizing access to system resources is maintained and implemented. Set up the userids with the RACF PROTECTED attribute. A sample RACF command to accomplish is shown here: ALU NOPASSWORD NOOIDCARD.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.