The IBM z/VM TCP/IP DTCPARMS files must be properly configured to connect to an external security manager.

From IBM z/VM Using CA VM:Secure Security Technical Implementation Guide

Associated with: CCI-000015

SV-93549r1_rule The IBM z/VM TCP/IP DTCPARMS files must be properly configured to connect to an external security manager.

Vulnerability discussion

A comprehensive account management process such as provided by External Security Managers (ESM) which includes automation helps to ensure accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to, using automation to take action on multiple accounts designated as inactive, suspended, or terminated, or by disabling accounts located in non-centralized account stores such as multiple servers. This requirement applies to all account types, including individual/user, shared, group, system, guest/anonymous, emergency, developer/manufacturer/vendor, temporary, and service. DTCPARMS setting assures that an ESM is enabled.Account management functions include: assigning group or role membership; identifying account type; specifying user access authorizations (i.e., privileges); account removal, update, or termination; and administrative alerts.

Check content

Determine location of “DTCPARMS” File for each of the following installed servers: FTP (FTPSERVE) IMAP (IMAP) NFS (VMNFS) REXEC (REXECD) If each “DTCPARMS” file includes the following statements, this is not a finding. :ESM_Enable.YES :ESM_Racroute.YES (or a valid exit name) :ESM_Validate.YES (or a valid exit name)

Fix text

For each of the following installed severs: FTP (FTPSERVE) IMAP (IMAP) NFS (VMNFS) REXEC (REXECD) Configure the DTCPARMS file in the TCP/IP configuration to include the following statements: :ESM_Enable.YES :ESM_Racroute.YES (or a valid exit name) :ESM_Validate.YES (or a valid exit name)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.