The Syslog daemon is improperly defined and secured.

Associated with IA controls: DCCS-1, DCFA-1, DCCS-2

SV-3243r1_rule The Syslog daemon is improperly defined and secured.

Vulnerability discussion

The Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the Syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.

Check content

a) Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTSTC) - ACF2CMDS.RPT(OMVSUSER) Refer to the following report produced by the UNIX System Services Data Collection: - USSCMDS.RPT(ERC) - Refer to this report if Syslogd is started from the shell. Refer to the JCL procedure libraries defined to JES2. b) Ensure the following items are in effect for the Syslog daemon: 1) The Syslog daemon logonid is SYSLOGD. If Syslogd is started from /etc/rc, the _BPX_JOBNAME environment variable is set to assign a job name of SYSLOGD. NOTE: If the _BPX_USERID environment variable is present, it is set to assign a logonid of SYSLOGD. 2) The SYSLOGD logonid is defined with the STC attribute. 3) The SYSLOGD logonid has the following z/OS UNIX attributes: UID(0), HOME directory ‘/’, shell program /bin/sh. c) If all of the items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.

Fix text

The systems programmer responsible for supporting ICS will ensure that Syslogd runs under its own user account. Specifically, it does not share the account defined for the z/OS UNIX kernel. Review the Syslog daemon account, privileges, and access authorizations defined to the ACP. Example: SET LID INSERT SYSLOGD NAME(SYSLOGD) GROUP(STCTCPX) STC SET PROFILE(USER) DIVISION(OMVS) INSERT SYSLOGD UID(0) HOME(/) PROGRAM(/bin/sh) F ACF2,REBUILD(USR),CLASS(P)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.