The z/OS Default profiles must not be defined in TSS OMVS UNIX security parameters for classified systems.

Associated with: CCI-000366

SV-7303r3_rule The z/OS Default profiles must not be defined in TSS OMVS UNIX security parameters for classified systems.

Vulnerability discussion

TSS UNIQUSER control option will automatically assign a UID to any user who logs on to OMVS without an OMVS segment. Parameter settings in the TSS impact the security level of z/OS UNIX. In classified systems user access will not be determined by default.

Check content

If the system in not classified this is not applicable. From a command line issue the following command: Note: One must have appropriate access to perform this command (have the site security officer to issue command). TSS MODIFY STATUS Examine the following options: UNIQUSER Alternately: Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(STATUS) - System Classification Automated Analysis requiring Additional Analysis: Refer to the following report produced by the TSS Data Collection: - PDI(ZUSST050) If system is classified and UNIQUSER is off i.e., (UNIQUSER(OFF) there is no finding.

Fix text

Ensure that Use of the OMVS default UIDs will not be allowed on any classified system. Set Control Option UNIQUSER off.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.