Check: RACF-TC-000050
IBM z/OS RACF STIG:
RACF-TC-000050
(in versions v8 r14 through v7 r1)
Title
The IBM RACF SERVAUTH resource class must be active for TCP/IP resources. (Cat II impact)
Discussion
IBM Provides the SERVAUTH Class for use in protecting a variety of TCP/IP features/functions/products both IBM and third-party. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.
Check Content
From a command input screen enter: SETROPTS LIST If there are TCP/IP resources defined and the SERVAUTH resource class is not active, this is a finding.
Fix Text
Configure RACF SETROPTS to have the SERVAUTH resource class is active. Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below: The RACF Command SETR LIST will show the status of RACF Controls including a list of ACTIVE classes. The SERVAUTH Class is activated with the command SETR CLASSACT (SERVAUTH). Generic profiles and commands should also be enabled with the command SETR GENERIC(SERVAUTH) GENCMD(SERVAUTH).
Additional Identifiers
Rule ID: SV-223824r604139_rule
Vulnerability ID: V-223824
Group Title: SRG-OS-000080-GPOS-00048
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000213 |
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
Controls
| Number | Title |
|---|---|
| AC-3 |
Access Enforcement |