From z/OS ACF2 STIG
Part of ACF0690
Associated with IA controls: DCCS-1, DCCS-2
Emergency USERIDs are necessary in the event of a system outage for recovery purposes. It is critical that those USERIDs be defined with the appropriate access to ensure timely restoration of services..
a) Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(LOGONIDS) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(TSOUADS) b) At a minimum an emergency logonid will exists with the security administration attributes specified in accordance with the following requirements: For emergency IDs with security administration privileges, but which cannot access and update system data sets: ACCOUNT NOFSRETAIN JCL JOB MONITOR NONON CNCL RULEVLD RSRCVLD SECURITY TSO TSOPROC(xxxxxxxx) TSOACCT(none) An additional class of userids can exist to perform all operating system functions except ACP administration. These emergency logonid / logonid(s) will have ability to access and update all system data sets, but will not have security administration privileges. See the following requirements: NOFSRETAIN JCL JOB MONITOR NON CNCL (Will force logging of all activity.) TSO TSOPROC(xxxxxxxx) TSOACCT(none) All emergency logonid / logonid(s) are to be implemented with logging to provide an audit trail of their activities. All emergency logonid / logonid(s) are to be maintained in both the ACP and SYS1.UADS to ensure they are available in the event that the ACP is not functional. All emergency logonid / logonid(s) will have distinct, different passwords in SYS1.UADS and in the ACP, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in the ACP. All emergency logonid / logonid(s) will have documented procedures to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the IAO. When an emergency logonid is released for use, its password is to be reset by the IAO within 12 hours. c) If all items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.
The IAO will ensure that Emergency Logonids use these fields to enforce restrictions for Emergency Userids. Two classes of emergency userids may exist. The following privileges and specifications will be used for these logonids: Note: Only the emergency logonid with the security administration logonid attributes is requried. (1) For emergency IDs with the ability to access and update all system data sets, but which do not have security administration privileges: NOFSRETAIN JCL JOB MONITOR NON CNCL (Will force logging of all activity.) TSO TSOPROC(xxxxxxxx) TSOACCT(none) Example: SET LID INSERT logonid NOFSRETAIN JCL JOB MONITOR NON-CNCL TSO TSOPRC(xxxxxxxx) TSOACCT(none) (2) For emergency IDs with security administration privileges, but which cannot access and update system data sets: ACCOUNT NOFSRETAIN JCL JOB MONITOR NONON CNCL RULEVLD RSRCVLD SECURITY TSO TSOPROC(xxxxxxxx) TSOACCT(none) Example: SET LID INSERT logonid ACCOUNT NOFSRETAIN JCL JOB MONITOR RULEVLD RSRCVLD NONON-CNCL SECURITY TSO TSOPRC(xxxxxxxx) TSOACCT(none)
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer