STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

IBM z/OS UNIX user accounts must be properly defined.

DISA Rule

SV-224097r561402_rule

Vulnerability Number

V-224097

Group Title

SRG-OS-000104-GPOS-00051

Rule Version

TSS0-US-000240

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

Configure each user account to be defined as specified below:

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Check Contents

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

From the ISPF Command Shell enter:
TSS LIST(ACIDS) SEGMENT(OMVS)

If any user account is not defined as follows, this is a finding.

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Vulnerability Number

V-224097

Documentable

False

Rule Version

TSS0-US-000240

Severity Override Guidance

NOTE: This only applies to users of z/OS UNIX (i.e., users with an OMVS profile defined).

From the ISPF Command Shell enter:
TSS LIST(ACIDS) SEGMENT(OMVS)

If any user account is not defined as follows, this is a finding.

-A unique UID number (except for UID(0) users)
-A unique HOME directory (except for UID(0) and other system task accounts)
-Shell program specified as "/bin/sh", "/bin/tcsh", "/bin/echo", or "/bin/false"

NOTE: The shell program must have one of the specified values. The HOME directory must have a value (i.e., not be allowed to default).

Check Content Reference

M

Target Key

4102

Comments