Title

The IBM z/VM LOGONBY must be restricted to system administrators. (Cat II impact)

Discussion

In certain situations, software applications/programs need to execute with elevated privileges to perform required functions. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking such applications/programs, those users are indirectly provided with greater privileges than assigned by the organizations. The LOGONBY statement designates up to eight user IDs that can use their own passwords to log on to and use the virtual machine.

Check Content

Examine each of the directory statements. If the “LOGONBY” statement specifies users that are not system administrators, this is a finding.

Fix Text

Assure that any “LOGONBY” statement only includes users who are system administrators.

Additional Identifiers

Rule ID:

Vulnerability ID: IBMZ-VM-000990

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.