STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

The IBM z/OS BPX.SMF resource must be properly configured.

DISA Rule

SV-223537r533198_rule

Vulnerability Number

V-223537

Group Title

SRG-OS-000032-GPOS-00013

Rule Version

ACF2-OS-000010

Severity

CAT II

CCI(s)

• CCI-000067 - The information system monitors remote access methods.

Weight

10

Fix Recommendation

Configure Facility resource class for BPX.SMF as follows:
BPX.SMF.119.94 – READ allowed for users running the ssh, sftp, or scp client commands.
BPX.SMF.119.96 – READ allowed for users running the scp or sftp-server server commands.
BPX.SMF.119.97 – READ allowed for users running the scp or sftp client commands.

The following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:
BPX.SMF – READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable.

Check Contents

Review the FACILITY resource class for BPX.SMF.

If the RACF rules are as follows, this is not a finding.

BPX.SMF.119.94 – READ allowed for users running the ssh, sftp, or scp client commands.
BPX.SMF.119.96 – READ allowed for users running the scp or sftp-server server commands.
BPX.SMF.119.97 – READ allowed for users running the scp or sftp client commands.

The following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:
BPX.SMF – READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable.

Vulnerability Number

V-223537

Documentable

False

Rule Version

ACF2-OS-000010

Severity Override Guidance

Review the FACILITY resource class for BPX.SMF.

If the RACF rules are as follows, this is not a finding.

BPX.SMF.119.94 – READ allowed for users running the ssh, sftp, or scp client commands.
BPX.SMF.119.96 – READ allowed for users running the scp or sftp-server server commands.
BPX.SMF.119.97 – READ allowed for users running the scp or sftp client commands.

The following profile grants the permitted users the authority to write or test for any SMF record being recorded. Access should be permitted as follows:
BPX.SMF – READ access only when documented and justified in Site Security Plan. Documentation should include a reason why a more specific profile is not acceptable.

Check Content Reference

M

Target Key

4100

Comments