IBM z/OS ACF2 STIG

IBM z/OS ACF2 Security Technical Implementation Guide

The IBM z/OS ACF2 Security Technical Implementation Guide (V9 R10) has 226 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

226STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R10

CurrentPublished Wed Sep 30 2026

IBM z/OS permission bits and user audit bits for HFS objects that are part of the FTP Server component must be properly configured.

IBM z/OS ACF2 Security Technical Implementation Guide

Assessment Title

Rule Text

IBM z/OS permission bits and user audit bits for HFS objects that are part of the FTP Server component must be properly configured.

Description

Discussion Text

MVS data sets of the FTP Server provide the configuration and operational characteristics of this product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of customer data and some system services.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223519

Rule

SV-223519r1268226_rule

Severity

medium

Rule Version

ACF2-FT-000030

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the ISPF Command shell, enter:
omvs
At the input line enter:
cd /usr/sbin/
enter
ls -alW

If the following file permission and user Audit Bits are true, this is not a finding.

/usr/sbin/ftpd 1740 fff
/usr/sbin/ftpdns 1755 fff

cd
ls -alW

If the following file permission and user Audit Bits are true, this is not a finding.

/etc/ftp.data 0744 faf
/etc/ftp.banner 0744 faf

NOTE: Some of the files listed above are not used in every configuration. The absence of a file is not considered a finding.

The /usr/sbin/ftpd and /usr/sbin/ftpdns objects are symbolic links to /usr/lpp/tcpip/sbin/ftpd and /usr/lpp/tcpip/sbin/ftpdns, respectively. The permission and user audit bits on the targets of the symbolic links must have the required settings.

The /etc/ftp.data file may not be the configuration file the server uses. It is necessary to check the SYSFTPD DD statement in the FTP started task JCL to determine the actual file.

The /etc/ftp.banner file may not be the banner file the server uses. It is necessary to check the BANNER statement in the FTP Data configuration file to determine the actual file. Also, the permission bit setting for this file must be set as indicated in the table above. A more restrictive set of permissions is not permitted.

The following represents a hierarchy for permission bits from least restrictive to most restrictive:

7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)

The possible audit bits settings are as follows:

f log for failed access attempts
a log for failed and successful access
- no auditing

Implementation Procedure

Fix Text

Ensure the UNIX permission bits and user audit bits on the HFS directories and files for the FTP Server conform to the specifications in the table below:

FTP Server HFS Object Security Settings
File Permission Bits User Audit Bits
/usr/sbin/ftpd 1740 fff
/usr/sbin/ftpdns 1755 fff
/etc/ftp.data 0744 faf
/etc/ftp.banner 0744 faf

The /usr/sbin/ftpd and /usr/sbin/ftpdns objects are symbolic links to /usr/lpp/tcpip/sbin/ftpd and /usr/lpp/tcpip/sbin/ftpdns respectively. The permission and user audit bits on the targets of the symbolic links must have the required settings.

The /etc/ftp.data file may not be the configuration file the server uses. It is necessary to check the SYSFTPD DD statement in the FTP started task JCL to determine the actual file.

The /etc/ftp.banner file may not be the banner file the server uses. It is necessary to check the BANNER statement in the FTP Data configuration file to determine the actual file.

The following represents a hierarchy for permission bits from least restrictive to most restrictive:

7 rwx (least restrictive)
6 rw-
3 -wx
2 -w-
5 r-x
4 r--
1 --x
0 --- (most restrictive)

The possible audit bits settings are as follows:

f log for failed access attempts
a log for failed and successful access
- no auditing

Some of the files listed above (e.g., /etc/ftp.data) are not used in every configuration. While the absence of a file is generally not a security issue, the existence of a file that has not been properly secured can often be an issue. Therefore, all files that do exist should have the specified permission and audit bit settings.

The following commands can be used (from a user account with an effective UID(0)) to update the permission bits and audit bits:

chmod 1740 /usr/lpp/tcpip/sbin/ftpd
chaudit rwx=f /usr/lpp/tcpip/sbin/ftpd
chmod 1755 /usr/lpp/tcpip/sbin/ftpdns
chaudit rwx=f /usr/lpp/tcpip/sbin/ftpdns
chmod 0744 /etc/ftp.data
chaudit w=sf,rx+f /etc/ftp.data
chmod 0744 /etc/ftp.banner
chaudit w=sf,rx+f /etc/ftp.banner

STIG check 97 of 226 in the IBM z/OS ACF2 STIG checklist

← Previous · V-223518IBM z/OS data sets for the FTP Server must be properly protected.Next · V-223520 →IBM z/OS FTP.DATA configuration statements must have a proper BANNER statement with the Standard Mandatory DoW Notice and Consent Banner.