Title

The z/OS Default profiles must not be defined in TSS OMVS UNIX security parameters for classified systems. (Cat II impact)

Discussion

TSS UNIQUSER control option will automatically assign a UID to any user who logs on to OMVS without an OMVS segment. Parameter settings in the TSS impact the security level of z/OS UNIX. In classified systems user access will not be determined by default.

Check Content

If the system in not classified this is not applicable. From a command line issue the following command: Note: One must have appropriate access to perform this command (have the site security officer to issue command). TSS MODIFY STATUS Examine the following options: UNIQUSER Alternately: Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(STATUS) - System Classification Automated Analysis requires Additional Analysis. Refer to the following report produced by the TSS Data Collection: - PDI(ZUSST050) If system is classified and UNIQUSER is off i.e., (UNIQUSER(OFF) there is no finding.

Fix Text

Ensure that Use of the OMVS default UIDs will not be allowed on any classified system. Set Control Option UNIQUSER off.

Additional Identifiers

Rule ID: SV-7303r4_rule

Vulnerability ID: V-7000

Group Title: ZUSST050

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.