Title

The startup user account for the z/OS UNIX Telnet Server is not defined properly. (Cat II impact)

Discussion

The z/OS UNIX Telnet Server (i.e., otelnetd) requires a UID(0) to provide its system services. After the user enters their userid and password, otelnetd switches to the security context of the users account. Because the otelnetd account is only used until authentication is completed, there is no need to require a unique account for this function. This limits the number of privileged accounts defined to the ACP and reduces the exposure potential. Failure to properly define and control otelnetd could lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.

Check Content

a) Refer to the following report produced by the UNIX System Services Data Collection: - USSCMDS.RPT(EINETD) b) If the otelnetd command specifies OMVS or OMVSKERN as the user, there is NO FINDING. c) If the otelnetd command specifies any user other than OMVS or OMVSKERN, this is a FINDING.

Fix Text

Review the otelnetd startup command in the inetd.conf file and ensure the account is defined for the z/OS UNIX kernel. The user account used at the startup of otelnetd is specified in the inetd configuration file. This account is used to perform the identification and authentication of the user requesting the session. Because the account is only used until user authentication is completed, there is no need for a unique account for this function. The z/OS UNIX kernel account can be used.

Additional Identifiers

Rule ID: SV-3229r2_rule

Vulnerability ID: V-3229

Group Title: IUTN0010

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.