STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

The IBM z/OS FTP server daemon must be defined with proper security parameters.

DISA Rule

SV-223979r561402_rule

Vulnerability Number

V-223979

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

TSS0-FT-000070

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Configure FTP daemon with the following items:

-The FTP daemon is started from a JCL procedure library defined to JES2.

NOTE: The JCL member is typically named FTPD.

-The FTP daemon ACID is FTPD.

-The FTPD ACID has the STC facility.

-The FTPD ACID has the following z/OS UNIX attributes:
UID(0), HOME directory ‘/’, shell program /bin/sh.

For example:
TSS CREATE(FTPD) TYPE(USER) NAME(FTPD)
DEPT(existing-dept) FACILITY(STC) PASSWORD(password,0)
TSS ADD(FTPD) DFLTGRP(STCTCPX) GROUP(STCTCPX)
TSS ADD(FTPD) SOURCE(INTRDR)
TSS ADD(FTPD) UID(0) HOME(/) OMVSPGM(/bin/sh)
TSS ADD(FTPD) MASTFAC(TCP)
TSS ADD(STC) PROCNAME(FTPD) ACID(FTPD)
TSS PERMIT(FTPD) IBMFAC(BPX.DAEMON) ACCESS(READ)
TSS PERMIT(FTPD) IBMFAC(BPX.POE) ACCESS(READ)
TSS PERMIT(FTPD) SERVAUTH(EZB.STACKACCESS.)ACCESS(READ)

Check Contents

From the ISPD Command Shell enter:
TSS LIST(FTPD) SEGMENT(OMVS)
NOTE: The JCL member is typically named FTPD

If the FTPD ACID has the STC facility this is not a finding.

If the FTPD ACID has the following z/OS UNIX attributes this is not a finding.

UID(0), HOME directory ‘/’, shell program /bin/sh.

Vulnerability Number

V-223979

Documentable

False

Rule Version

TSS0-FT-000070

Severity Override Guidance

From the ISPD Command Shell enter:
TSS LIST(FTPD) SEGMENT(OMVS)
NOTE: The JCL member is typically named FTPD

If the FTPD ACID has the STC facility this is not a finding.

If the FTPD ACID has the following z/OS UNIX attributes this is not a finding.

UID(0), HOME directory ‘/’, shell program /bin/sh.

Check Content Reference

M

Target Key

4102

Comments