What changed in IBM zVM Using CA VM:Secure STIG V2R2V2R2 changes

CCIs

CCI-000018,CCI-000067,CCI-000130,CCI-000131,CCI-000132,CCI-000133,CCI-000134,CCI-000135,CCI-000169,CCI-000172,CCI-001403,CCI-001404,CCI-001405,CCI-001487,CCI-001814001844,CCI-002130002160,CCI-002234002264,CCI-002884002914

V-237899 in V2R2

Check text

Display the System Configuration File. If the "JOURNALING" statement is set to: Facility ON LOGON Lockout after 3three attempts for 15 minutes, this is not a finding. Note: Site may set Lockout value at 0, this will require system administrator action for reset. Issue "QUERY JOURNAL" command. If the response is as follows this is not a finding: Journal: LOGON-on

Fix text

Configure the System Configuration "JOURNALING" statement to: Facility ON LOGON Lockout after 3 attempts for 15 minutes or 0 if system administrator action is desired.

V-237900 in V2R2

Check text

If there are no FTP servers’ active, this is not applicable. Issue "SMSG" command for each FTP Server. Query "FTAUDIT". If the "Exit" is not enabled, this is a finding.

V-237905 in V2R2

CCIs

CCI-000068,CCI-001453,CCI-0024148,CCI-0024251,CCI-0024522,CCI-0028920,CCI-0031253

V-237906 in V2R2

Fix text

Configure the Product Configuration files’' JOURNALING statement to "JOURNALING ON".

V-237908 in V2R2

Check text

Invoke the "gskkyman" utility. From the "Key Management" Menu display Certificate Information. If no certificate information is found, this is not a finding. Note: Certificates are only valid when their status is "TRUST". Therefore, you may ignore certificates with the "NOTRUST" status during the following checks. If the digital certificate information indicates that the issuer's distinguished name leads to a DoD PKI Root Certificate Authority or External Certification Authority (ECA), this is not a finding. Reference the IASECyber Exchange website for complete information as to which certificates are acceptable (httphttps://iasecyber.disa.mil/pki-pke/interoperabilitypkipke-document-library/).

Fix text

Remove or and replace certificates whose issuer's distinguished name does not lead to a DoD PKI Root Certification Authority, External Root Certification Authority (ECA), or an approved External Partner PKI’'s Root Certification Authority.

V-237909 in V2R2

Check text

Issue command openvm list /etc./gskadm/ (own) If the file permissions are as displayed below, this is not a finding. User ID Group Name Permissions Type Path name component gskadmin security rw- r-- --- F ’'Database.kdb’' gskadmin security rw- --- --- F ’'Database.rdb’' gskadmin security rw- r-- --- F ’'Database.sth’'

Fix text

Ensure proper permissions are assigned to Kkey databases. Issue the "OPENVM PERMIT" commands to assign proper permissions.

V-237910 in V2R2

CCIs

CCI-000213,CCI-000366,CCI-000764,CCI-000804,CCI-00177804

V-237917 in V2R2

Check text

Examine "AUTHORIZ CONFIG" file. If Authorizations are granted as follows, this is not a finding. Grant the CA VM:Secure system administrator authorization to use all commands and menu selections. Grant directory managers authorization to use a particular command, group of commands, or menu selection. By carefully planning these authorizations, you can delegate many of the daily directory and disk space management tasks to the directory managers. Plan these authorizations carefully to cover all aspects of your site’'s VM installation. Grant general users authorization to use those commands and menu selections that enable them to manage their own virtual machine. Users can then perform tasks such as maintaining their own system password and controlling access to their minidisks by others.

Fix text

Assure that the following authorizations are configured: Grant the CA VM:Secure system administrator authorization to use all commands and menu selections. Grant directory managers authorization to use a particular command, group of commands, or menu selection. By carefully planning these authorizations, you can delegate many of the daily directory and disk space management tasks to the directory managers. Plan these authorizations carefully to cover all aspects of your site’'s VM installation. Grant general users authorization to use those commands and menu selections that enable them to manage their own virtual machine. Users can then perform tasks such as maintaining their own system password and controlling access to their minidisks by others. For example, for users in the Technical Support group, you may want to authorize them to use all selections on the "User Selection" menu.

CCIs

CCI-0018143

V-237936 in V2R2

Check text

Examine the "MDISK" statement for journaling. If the space allocations are not large enough for one weeks’' worth of audit records, this is a finding.

CCIs

CCI-0018479

V-237937 in V2R2

CCIs

CCI-0019697

V-237940 in V2R2

CCIs

CCI-0021695

V-237941 in V2R2

Fix text

Assure that any "LOGONBY" rules in the CA VM: Secure Rules Facility only specifies users who are system administrators.

CCIs

CCI-0022633

V-237942 in V2R2

Check text

View system config "JOURNALING" statement. If the "JOURNALING" statement "LOGON" operand is configured as below, this is not a finding. Logon, Account after 3 attempts, See IBMZ-VM-000040 for LOCKOUT setting. Link, Account after 3 attempts, Disable after 3 attempts

CCIs

CCI-0022368

V-237944 in V2R2

CCIs

CCI-0024250,CCI-0024522

V-237945 in V2R2

CCIs

CCI-0023144

V-237946 in V2R2

CCIs

CCI-0024250

V-237947 in V2R2

CCIs

CCI-0024522

V-237948 in V2R2