STIGQter: STIG Summary: IBM MQ Appliance V9.0 AS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The MQ Appliance messaging server must produce log records containing information to establish what type of events occurred.

DISA Rule

SV-89551r1_rule

Vulnerability Number

V-74877

Group Title

SRG-APP-000095-AS-000056

Rule Version

MQMH-AS-000210

Severity

CAT II

CCI(s)

• CCI-000130 - The information system generates audit records containing information that establishes what type of event occurred.
• CCI-000131 - The information system generates audit records containing information that establishes when an event occurred.
• CCI-000132 - The information system generates audit records containing information that establishes where the event occurred.
• CCI-000133 - The information system generates audit records containing information that establishes the source of the event.
• CCI-000134 - The information system generates audit records containing information that establishes the outcome of the event.
• CCI-000135 - The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.
• CCI-001462 - The information system provides the capability for authorized users to capture/record and log content related to a user session.
• CCI-001487 - The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.

Weight

10

Fix Recommendation

Ensure each queue is configured to log the following event names:

AUTHOREV
INHIBITEV
STRSTPEV
CMDEV
SSLEV
CONFIGEV
PERFMEV

Use the "runmqsc" command for each queue manager.

runmqsc [queue mgr name]
ALTER QMGR [event name](ENABLED)

Enter "end" to exit the MQ Appliance CLI.

Check Contents

Apply the following check to each queue manager on the MQ Appliance.

Establish an SSH command line session as an admin user.

To access the MQ Appliance CLI, enter:
mqcli

To identify the queue managers, enter:
dspmq

To check config for each queue, enter:
runmqsc [queue mgr name]

At the runmqsc prompt, enter:
DIS QMGR EVENT

Verify the following events are enabled as required.

AUTHOREV, INHIBITEV, STRSTPEV, CMDEV, SSLEV, CONFIGEV, PERFMEV

If any of the required events are not enabled, this is a finding.

Vulnerability Number

V-74877

Documentable

False

Rule Version

MQMH-AS-000210

Severity Override Guidance

Apply the following check to each queue manager on the MQ Appliance.

Establish an SSH command line session as an admin user.

To access the MQ Appliance CLI, enter:
mqcli

To identify the queue managers, enter:
dspmq

To check config for each queue, enter:
runmqsc [queue mgr name]

At the runmqsc prompt, enter:
DIS QMGR EVENT

Verify the following events are enabled as required.

AUTHOREV, INHIBITEV, STRSTPEV, CMDEV, SSLEV, CONFIGEV, PERFMEV

If any of the required events are not enabled, this is a finding.

Check Content Reference

M

Target Key

3239

Comments