Check: ACF0500
zOS ACF2 STIG:
ACF0500
(in versions v6 r43 through v6 r30)
Title
The TSO GSO record values must be set to the values specified. (Cat II impact)
Discussion
The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any one of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during a migration process or contingency plan activation.
Check Content
Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO) Automated Analysis Refer to the following report produced by the ACF2 Data Collection: - PDI(ACF0500) If the GSO TSO record values conform to the following requirements, this is not a finding. ACCOUNT(1) BYPASS(#) CHAR(BS) CMDLIST() NOIKJEFLD1 LINE(ATTN) LOGONCK PERFORM(0) PROC(site defined) NOQLOGON REGION(site defined) SUBCLSS() SUBHOLD() SUBMSG() TIME(0) TSOSOUT(A) UNIT(SYSDA) WAITIME(60) or less
Fix Text
The IAO will ensure that the TSO GSO values are set to the values specified. Ensure the GSO TSO record values conform to the following requirements. ACCOUNT(1) BYPASS(#) CHAR(BS) CMDLIST() NOIKJEFLD1 LINE(ATTN) LOGONCK PERFORM(0) PROC(site defined) NOQLOGON REGION(site defined) SUBCLSS() SUBHOLD() SUBMSGC() TIME(0) TSOSOUT(A) UNIT(SYSDA) WAITIME(60) or less Example: SET C(GSO) INSERT TSO ACCOUNT(1) BYPASS(#) CHAR(BS) CMDLIST() NOIKJEFLD1 LINE(ATTN) LOGONCK PERFORM(0) PROC(IKJACCNT) NOQLOGON REGION(4,096) SUBCLSS() SUBHOLD() SUBMSGC() TIME(0) TSOGNAME() TSOSOUT(A) UNIT(SYSDA) WAITIME(60) F ACF2,REFRESH(TSO)
Additional Identifiers
Rule ID: SV-152r4_rule
Vulnerability ID: V-152
Group Title: ACF0500
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |