z/OS UNIX resources must be protected in accordance with security requirements.

From z/OS TSS STIG

Part of ZUSS0022

Associated with: CCI-000213 CCI-002233

SV-19747r4_rule z/OS UNIX resources must be protected in accordance with security requirements.

Vulnerability discussion

z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.

Check content

Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection: - TSSCMDS.RPT(WHOOSURR) - SENSITVE.RPT(WHOHSURR) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZUSS0022) Ensure that the following resources and/or generic equivalents are properly protected according to the requirements specified below for the SURROGAT resource class. If the following guidance is true, this is not a finding. ___ The TSS resources and/or generic equivalent for BPX. is owned or DEFPROT is specified for the resource class. ___ The TSS resource access authorizations restrict BPX.SRV.user to system software processes (e.g., web servers) that act as servers under z/OS UNIX.

Fix text

The Systems Programmer and IAO will ensure that BPX. SRV.userid resources are properly protected and access is restricted to appropriate system tasks or systems programming personnel. SURROGAT class BPX resources are used in conjunction with server applications that are performing tasks on behalf of client users that may not supply an authenticator to the server. This can be the case when clients are otherwise validated or when the requested service is performed from userids representing groups. a) Ensure there is a TSS owner defined for the (BPX.) SURROGAT class resource. For Example: TSS ADD(dept) SURROGAT(BPX.) b) Ensure the TSS rules for all BPX.SRV.user SURROGAT resources restrict access to system software processes (e.g., web servers) that act as servers under z/OS UNIX. For Example: TSS PERMIT() SURROGAT(BPX.SRV.) ACCESS(READ)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer