What changed in zOS WebSphere MQ for RACF STIG V7R3V7R3 changes

Check text

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid). NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). Collect the following Information for WebSphere MQ and MQSeries queue manager. - If a WebSphere MQ queue manager communicates with aanother MQSeriesWebSphere MQ queue manager, provide the WebSphere MQ queue manager and channel names used to connect withthese MQSeriesqueue managers. Automated Analysis requires Additional Analysis. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0011). If the following guidelines are true for each channel definition displayed from the DISPLAY CHANNEL command, this is not a finding. ___ Verify that each WebSphere MQ channel is using SSL by checking for the SSLCIPH parameter, which must specify a FIPS 140-2 3-compliant value of the following: (Note: Both ends of the channel must specify the same cipher specification.) ECDHE_ECDSA_AES_128_CBC_SHA256The following suites are allowed for the TLS 1.3 protocol: ECDHE_ECDSA_AES_256_CBC_SHA384TLS_AES_128_GCM_SHA256 ECDHE_RSA_AES_128_CBC_SHA256TLS_AES_256_GCM_SHA384 ECDHE_RSA_AES_256_CBC_SHA384 TLS_RSA_WITH_3DES_EDE_CBC_SHAThe following suites are allowed for the TLS 1.2 protocol: TLS_RSA_WITH_AES_128_CBC_SHATLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA256TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHATLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_CBC_SHA256TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 ___ TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 Repeat the above step for each queue manager ssid identified.

Fix text

Review the WebSphere MQ Screen interface invoked by the REXX CSQOREXX. Reviewing the channel's SSLCIPH setting. Display the channel properties and look for the "SSL Cipher Specification" value. Ensure that a FIPS 140-2 3-compliant value is shown. ECDHE_ECDSA_AES_128_CBC_SHA256The following suites are allowed for the TLS 1.3 protocol: ECDHE_ECDSA_AES_256_CBC_SHA384TLS_AES_128_GCM_SHA256 ECDHE_RSA_AES_128_CBC_SHA256TLS_AES_256_GCM_SHA384 ECDHE_RSA_AES_256_CBC_SHA384 TLS_RSA_WITH_3DES_EDE_CBC_SHAThe following suites are allowed for the TLS 1.2 protocol: TLS_RSA_WITH_AES_128_CBC_SHATLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA256TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHATLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_256_CBC_SHA256TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 Note that both ends of the channel must specify the same cipher specification. Repeat these steps for each queue manager ssid identified.

Discussion

WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity, and mutual authentication between clients and servers. Failure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data. Satisfies: SRG-OS-000505, SRG-OS-000555

V-224551 in V7R3

Check text

a) Refer to the following report produced by the MQSeriesz/WebSphereOS MQ Data Collection: - MQSERIES.RPTMQSRPT(MQSssidssid). NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). To determine which releaseRelease of MQSeries/WebSphere MQ, review MQSssidssid reportreports for message CSQU000I. Refer toCollect the following itemInformation gatheredfor fromeach the MQSeries/WebSphere MQ Worksheetqueue inmanager. the Preliminary Information Worksheets: - DOC(MQWMQNFO) b) If sitea isWebSphere runningMQ MQSeriesqueue 5.2manager orcommunicates belowwith another WebSphere MQ queue manager, thisprovide isthe NOTWebSphere APPLICABLEMQ queue manager and channel names used to connect these queue managers. c)- ForIf eachany WebSphere MQ 5.3channels andare aboveused to communicate within the enclave, reviewprovide a list of channels and provide documentation regarding the MQSssidsensitivity of the information on the channel. Review the ssid report(s) and perform the following steps:. If the following guidance for each queue manager ssid is true, this is not a finding. 1) Find the DISPLAY QMGR DEADQ, SSLKEYR, SCYCASE command to locate the start of the Queue Manager definitions. 2) Verify that each WebSphere MQ 5.3 queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified,. i.e., SSLKEYR(sslkeyring-id). 3) Issue the following RACF commands, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtained from the above action: RACDCERT ID(ssidCHIN) LISTRING(sslkeyring-id) NOTENote: The sslkeyring-id is case sensitive. The output will contain columns for Certificate Label Name and Cert Owner. Find the Cert Owner of ID(ssidCHIN). Use the Certificate Label Name for ID(ssidCHIN) in the following command: RACDCERT ID(ssidCHIN) LIST(LABEL('Certificate Label Name')) NOTENote: The Certificate Label Name is case sensitive. Review the Issuer's Name field in the resulting output for information on any of the following: OU=PKI.OU=DoD.O=U.S. Government.C=US OU=ECA.O=U.S. Government.C=US 4) Repeat these steps for each queue manager ssid identified. d) If the all of the items in (c) above are true, there is no finding. e) If any of the items in (c) above are untrue, this is a finding.

Fix text

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Find the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions. 2) Verify that each WebSphere MQ queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified, i.e., SSLKEYR(sslkeyring-id). 3) Issue the following RACF commands, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtained from the above action: RACDCERT ID(ssidCHIN) LISTRING(sslkeyring-id) NOTENote: The sslkeyring-id is case sensitive. The output will contain columns for Certificate Label Name and Cert Owner. Find the Cert Owner of ID(ssidCHIN). Use the Certificate Label Name for ID(ssidCHIN) in the following command: RACDCERT ID(ssidCHIN) LIST(LABEL('Certificate Label Name')) NOTENote: The Certificate Label Name is case sensitive. Review the Issuer's Name field in the resulting output for information on any of the following: OU=PKI.OU=DoD.O=U.S. Government.C=US OU=ECA.O=U.S. Government.C=US 4) Repeat these steps for each queue manager ssid identified. To implement the requirements stated above, the following two items are provided which attempt to assist with (1) Technical "how to" information and (2) A DISA Point of contact for obtaining SSL certificates for CSD WebSphere MQ channels: 1. Review the information available on setting up SSL, Keyrings, and Digital Certificates in the RACF Security Administrator's Guide as well as the WebSphere MQ Security manual. Also review the information contained in the documentation provided as part of the install package from the DISA SSO Resource Management Factory (formerly Software Factory). 2. For information on obtaining an SSL certificate in the DISA CSD environment, send email inquiry to disaraoperations@disa.mil.

V-224552 in V7R3

Check text

Validate that the list of all Production WebSphere MQ Remotes exist,exists and contains approved Certified Name Filters and associated USERIDS. If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding. If there is no Certificate Name Filter for WebSphere MQ Remotes this is a Finding. Note: Improper use of CNF filters for MQ Series will result in the following Message ID. CSQX632I found in the following example: CSQX632I csect-name SSL certificate has no associated user ID, remote channel channel-name - channel initiator user ID used

V-224553 in V7R3

Check text

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) Note: ssid is the queue manager name (a.k.a., subsystem identifier). Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0020) Review the ssid report(s) and perform the following steps: 1. Find the DISPLAY SECURITY command to locate the start of the security parameter settings. 2. Review the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively. 3. Repeat these steps for each queue manager ssid. The standard values are: TIMEOUT(15) INTERVAL(5) If the Timeout and Interval values conform to the standard values, this is not a finding. If the Timeout and/or Interval values do not conform to the standard values, this is a finding.

Discussion

Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.

V-224554 in V7R3

Check text

a) Refer to the following reports produced by the RACF Data Collection: - DSMON.RPT(RACSPT) - RACFCMDS.RPT(LISTUSER) Note: ssid is the queue manager name (a.k.a., subsystem identifier). Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels. b) Review WebSphere MQ started tasks and ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). ssidMSTR is the name of a queue manager STC. ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC. 1) EachReview ssidMSTRWebSphere MQ started tasks and ssidCHINensure startedthe taskfollowing isitems associatedare within aeffect, uniquethis useridis not a finding. 2) All ssidMSTR and ssidCHIN started tasks are definedassociated towith thea STARTEDunique resource classuserid. 3) All ssidMSTR and ssidCHIN started tasks useriduserids are defined aswith athe attribute of PROTECTED. c) IfssidMSTR bothand ofssidCHIN thestarted itemstasks in (b) are true,defined thereto isthe NOSTARTED FINDINGresource class. d) IfRepeat eitherthese itemsteps infor (b)each isqueue untrue,manager this is a FINDINGssid.

Fix text

Each queue manager started task procedure xxxxMSTR and distributed queuing started task procedure xxxxCHIN will have a matching profile defined to the STARTED resource class. Create a corresponding userid for each started task. The STC userids will be defined as PROTECTED userids. Queue manager and channel initiator started tasks will not be defined with the TRUSTED attribute. The following sample contains commands to properly define the required Started Procs: Note that this example uses "qmq1" as the value for ssid. AU qmq1mstr NAME('STC, MQSERIES') NOPASS DFLTGRP(STC) OWNER(STC) DATA('MQSERIES QUEUE MANAGER PROC') AU qmq1chin NAME('STC, MQSERIES') NOPASSDFLTGRP(STC) OWNER(STC) DATA('MQSERIES DISTRIBUTED QUEUING CHANNEL INIT PROC') RDEF STARTED qmq1mstr.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1mstr USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES)) RDEF STARTED qmq1chin.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MAP qmq1mstr PROC TO qmq1chin USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES)) SETR RACL(STARTED) REFRESH

Discussion

Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data.

V-224555 in V7R3

Check text

Refer to the following report produced by the ACP Data Collection: - SENSITVE.RPT(MQSRPT) EnsureVerify ACP data sets rules for MQSeries/WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows:. If the following guidance is true, this is not a finding. Note: ssid is the queue manager name (a.k.a., subsystem identifier). If the following guidance is true, this is not a finding. The ACP data set rules for the data sets restricts READ access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and systemsystems programming personnel. All access to these data sets is logged. DDname Procedure Description CSQINP1 ssidMSTR Input parameters CSQINP2 ssidMSTR Input parameters CSQXLIB ssidCHIN User exit library Note:The ACP data set rules for the data sets restricts WRITE/UPDATE and/or ALLOCATE/ALTERgreater access to thesethe above data sets is restricted to MQSeries/WebSphere MQ administrators and systems programming personnel. The ACP data set rules for the data sets restricts WRITE/UPDATE and/or ALLOCATE/ALTERgreater access to data sets referenced by the following DDnames, is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and systems programming personnel. All WRITE and/or ALLOCATEgreater access to these data sets is logged. DDname Procedure Description CSQPxxxx ssidMSTR Page data sets BSDSx ssidMSTR Bootstrap data sets CSQOUTx ssidMSTR SYSOUT data sets CSQSNAP ssidMSTR DUMP data set (See note) ssidMSTR Log data sets Note: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain DSNsdata set names. ALLOCATE/The ACP data set rules for the data sets restricts ALTER access to archive data sets is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrator, and systemsystems programming personnel. All ALLOCATE/ALTER access to these data sets is logged. Note: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 DSNdata HLQsset high level qualifiers. Except for the specific data set requirements just mentioned, WRITE/UPDATE and/or ALLOCATE/ALTERgreater access to all other MQSeries/WebSphere MQ system data sets is restricted to the MQSeries/WebSphere MQ administrator and systemsystems programming personnel. If all the items above are true, this is not a finding. If any item above is untrue, this is a finding.

Fix text

The systems programmer will have the ISSO ensure that all updateWRITE and/or altergreater access to MQSeries/WebSphere MQ product and system data sets areis restricted to WebSphere MQ administrators, systems programmers, and MQSeries/WebSphere MQ started tasks. The installation requires that the following data sets be APF authorized. hlqual.SCSQAUTH hlqual.SCSQLINK hlqual.SCSQANLx hlqual.SCSQSNL hlqual.SCSQMVR1 hlqual.SCSQMVR2 ReadREAD access to data sets referenced by the CSQINP1, CSQINP2, and CSQXLIB DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all access to these data sets. WriteWRITE and/or allocategreater access to data set profiles protecting all page sets, logs, bootstrap data sets (BSDS), and data sets referenced by the CSQOUTX and CSQSNAP DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all writeWRITE and/or allocategreater access to these data sets. AllocateALTER access to all archive data sets in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all allocateALTER access to these data sets.

V-224556 in V7R3

Check text

Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) - DSMON.RPT(RACCDT) - Alternate list of active resource classes Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZWMQ0049) EnsureVerify the following WebSphere MQ resource classes are active:, this is not a finding. GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE If theSCYCASE classesis notedset aboveto are not activeMIXED, thisensure isthe afollowing finding. WhenWebSphere SCYCASEMQ isresource setclasses toare mixedactive, CLASMAPthis Definitionsis mustnot includea the following entries:finding. GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC If when SCYCASE is set to mixed, CLASMAP Definitions do not include the entries shown above, this is a finding. NOTENote: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

Fix text

Ensure that all WebSphere MQ resources are active and properly defined. Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC NOTENote: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed. The following sample contains commands to activate the required classes: SETR CLASSACT(MQADMIN MQCMDS MQCONN) SETR CLASSACT(MQNLIST MQPROC MQQUEUE) SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)

V-224557 in V7R3

Check text

a) Refer to the following report produced by the Zz/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Automated Analysis requires Additional Analysis. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0051) b)Note: ssid is the queue manager name (a.k.a., subsystem identifier). Review the Security switches identified in response to the DISPLAY SECURITY command in each ssid report(s). If all of the following switches specify ON, therethis is nonot a finding. SUBSYSTEM CONNECTION COMMAND CONTEXT ALTERNATE USER PROCESS NAMELIST QUEUE TOPIC COMMAND RESOURCES c) If SUBSYSTEM specifies OFF, this is a finding with a severity of Category I. d) If any of the other above switches specify OFF (other than the exception mentioned below), this is a finding. Downgradeand downgrade the severity to a Category II. e) If COMMAND RESOURCE Security switch specifies OFF, therethis is nonot a finding. NOTENote: At the discretion of the ISSO, COMMAND RESOURCE Security switch may specify OFF by defining ssid.NO.CMD.RESC.CHECKS in the MQADMIN (or MXADMIN if SCYCASE is settoset to MIXED) resource class.

Fix text

Ensure all switch profiles are special MQSeries/WebSphere MQ profiles that are used to turn on/off security checking for a type of resource. Due to the security exposure this creates, no profiles with the first two qualifiers of ssid.NO will be defined to the MQADMIN or MXADMIN class, with one exception. Due to the fact that (1) all sensitive MQSeries/WebSphere MQ commands are restricted to queue managers, channel initiators, and designated systems personnel, and (2) no command resource checking is performed on DISPLAY commands, at the discretion of the ISSO, a ssid.NO.CMD.RESC.CHECKS switch profile may be defined to the MQADMIN or MXADMIN class. 1. Identify if any switch profiles exist using the sample search command: SR CLASS(MQADMIN) NOMASK FILTER(*.NO.**) 2. Use the "RDEL MQADMIN &ltSwitchProfileName>" to remove the profile and follow up with a "SETR RACL(MQADMIN) REF". 3. An additional refresh to an active WebSphere MQ queue manager may be required. A sample is shown below using the value QMD1 as the queue manager name. From the Console: >QMD1 REFRESH SECURITY(*)

V-224558 in V7R3

Check text

Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQCONN) Review the following connection resources definedfor toeach thequeue MQCONNmanager resourcedefined classto orthe MXCONNconnection resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN. resourceIf classthe orfollowing MXCONNguidance resource class if SCYCASE is set to MIXEDtrue, ensurethis the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies accessfinding. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. If all of the items above are true, this is not a finding. If any item above is untrue, this is a finding.

Fix text

Review the following connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. A set of sample commands is provided below to implement the minimum profiles necessary for proper security. Note that the IMS and/or CICS profiles can be omitted if those products do not run on the target system. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQCONN ** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE') RDEF MQCONN &ltssid>.BATCH UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READAUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE &ltssid>.BATCH CL(MQCONN) ID(&ltapplicableTSO&batchUsers>) RDEF MQCONN &ltssid>.CICS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE &ltssid>.CICS CL(MQCONN) ID(&ltCICSRegionUserids>) RDEF MQCONN &ltssid>.IMS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE &ltssid>.IMS CL(MQCONN) ID(&ltIMSRegionUserids>) RDEF MQCONN &ltssid>.CHIN UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE &ltssid>.CHIN CL(MQCONN) ID(&ltWebsphereMQCHINUsrids>) SETR RACL(MQCONN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager Named QMD1: >QMD1 REFRESH SECURITY(*)

V-224559 in V7R3

Check text

a) Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). b) Review the ssid report(s) and perform the following steps: 1) Find the DISPLAY QMGR DEADQ command to locate the start of the dead-letter queue information. Review the DEADQ parameter to obtain the name of the real dead-letter queue. 2) From the top of the report, find the QUEUE(dead-letter.queue.name) entry to locate the start of the real dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to the specified security requirements. If the following values are set for the dead-letter.queue.name, this is not a finding. The standard values are: GET(ENABLED) PUT(ENABLED) NOTENote: Deaddead-letter.queue.name is the value of the DEADQ parameter determined in Step 1above. 3) From the top of the report, find the QUEUE(dead-letter.queue.name.PUT) entry to locate the start of the alias dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to those specified in the security requirements. If the following values are set for the dead-letter.queue.name.PUT, this is not a finding. The standard values are: GET(DISABLED) PUT(ENABLED) NOTE 1Note: Dead-letter.queue.name is the value of the DEADQ parameter determined in Step 1above. NOTE 2Note: The TARGQ parameter value for the alias queue will be the real dead letter queue name. NOTE 3Note: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue must be coded to restrict unauthorized users and systems from reading the messages on the file. c) If all of the items in (b) are true, there is no finding. d) If any item in (b) is untrue, this is a finding.

Fix text

The systems programmer responsible for supporting MQSeries/WebSphere MQ will ensure that the dead-letter queue and its alias are properly defined. The following scenario describes how to securely define a dead-letter queue: (1) Define the real dead-letter queue with attributes PUT(ENABLED) and GET(ENABLED). (2) Give update authority for the dead-letter queue to CKTI (the MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators, and any automated application used for dead-letter queue maintenance. (3) Define an alias queue that resolves to the real dead-letter queue, but give the alias queue the attributes PUT(ENABLED) and GET(DISABLED). (4) To put a message on the dead-letter queue, an application uses the alias queue. The application does the following: (a) Retrieve the name of the real dead-letter queue. To do this, it opens the queue manager object using MQOPEN, and then issues an MQINQ to get the dead-letter queue name. (b) Build the name of the alias queue by appending the characters ".PUT" to this name, in this case, ssid.DEAD.QUEUE.PUT. (c) Open the alias queue, ssid.DEAD.QUEUE.PUT. (d) Put the message on the real dead-letter queue by issuing an MQPUT against the alias queue. (5) Give the userid associated with the application update authority to the alias, but no access to the real dead-letter queue. NOTENote: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue will be coded to restrict unauthorized users and systems from reading the messages on the file. Undeliverable messages can be routed to a dead-letter queue. Two levels of access should be established for these queues. The first level allows applications, as well as some MQSeries/WebSphere MQ objects, to put messages to this queue. The second level restricts the ability to get messages from this queue and protects sensitive data. This will be accomplished by defining an alias queue that resolves to the real dead-letter queue, but defines the alias queue with the attributes PUT(ENABLED) and GET(DISABLED). The ability to get messages from the dead-letter queue will be restricted to message channel agents (MCAs), CKTI (MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators utility, and any automated application used for dead-letter queue maintenance.

V-224560 in V7R3

Check text

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid). NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). Refer to the following reports produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(MQQUEUE). - SENSITVE.RPT(MXQUEUE). For all queues identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. EnsureVerify these queue resources are defined to the MQQUEUE, and GMQQUEUE, MXQUEUE,resource classes (or GMXQUUEMXQUEUE and GMXQUEUE resource classes, if SCYCASE is set to MIXED). EnsureIf the following itemsguidance areis intrue, effect:this is not a finding. 1) Resource profiles are defined with a UACC(NONE). 2) For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. 3) For system queues (i.e., ssid.SYSTEM.queuename), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications. 4) For the following system queues, ensureverify that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, auditors, and users that require access to review message queues: ssid.SYSTEM.COMMAND.INPUT ssid.SYSTEM.COMMAND.REPLY ssid.SYSTEM.CSQOREXX.* 5) For system queues (i.e., ssid.SYSTEM.CSQUTIL.*), ensureverify that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, and auditors. 6) For the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance. 7) For the alias dead-letter queue (to determine queue name, refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.

Fix text

For all queue resources defined to the MQQUEUE, GMQQUEUE, MXQUEUE, or GMXQUEUE resource classes, ensure the following items are in effect: For all queues identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. Ensure these queue resources are defined to the MQQUEUE or GMQQUEUE resource classes. If the following guidance is true, this is not a finding. 1) Resource profiles are defined with a UACC(NONE). 2) For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Decentralized MQ administrators, non-DECC datacenter users, can have up to ALTER access to the user Message Queues. 3) For system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts UPDATE and/or ALTER access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications. 4) For the following system queues, ensure that UPDATE access is restricted to auditors and users that require access to review message queues. ssid.SYSTEM.COMMAND.INPUT ssid.SYSTEM.COMMAND.REPLY ssid.SYSTEM.CSQOREXX.* ssid.SYSTEM.CSQUTIL.* 5) For the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance. 6) For the alias dead-letter queue (to determine queue name, refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Example: RDEF MQQUEUE &ltssid>.SYSTEM.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054') PE &ltssid>.SYSTEM.** CL(MQQUEUE) ID(&ltRestrictedUsersAsSpecifiecAbove>) RDEF MQQUEUE &ltssid>.&ltqname>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054') PE &ltssid>.&ltqname> CL(MQQUEUE) ID(&ltAsSpecifiedAbove>) RDEF MQQUEUE &ltssid>.&ltRealDeadLetterQue>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054') PE &ltssid>.&ltRealDeadLetterQue> CL(MQQUEUE) ID(&ltAsSpecifiedAbove>) RDEF MQQUEUE &ltssid>.&ltAliasDeadLetterQue>.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) DATA('REQUIRED FOR ZWMQ0054') PE &ltssid>.&ltAliasDeadLetterQue> CL(MQQUEUE) ID(&ltAsSpecifiedAbove>) SETR RACL(MQQUEUE) REF

V-224561 in V7R3

Check text

a) Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQPROC). b)- SENSITVE.RPT(MXPROC). For all process resources (i.e., ssid.processname) defined to the MQPROC, and GMQPROC, MXPROC,resource classes (or MXPROC and GMXPROC resource classes, ensureif SCYCASE is set to MIXED). If the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to make process inquiresinquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. c) If both of the items in (b) are true, there is no finding. d) If either item in (b) is untrue, this is a finding.

Fix text

Process security validates userids authorized to issue MQSeries/WebSphere MQ inquiries on process definitions. A process definition object defines an application that is started in response to a trigger event on a queue manager. Process security will be active, and all profiles ssid.processname will be defined to the appropriate class. Restrict readREAD access to those userids requiring access to make process inquiries. For all process resources (i.e., ssid.processname) defined to the MQPROC, GMQPROC, MXPROC, and GMXPROC resource classes, ensure the following items are in effect: NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to make process inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. A set of sample commands are provided below to implement the minimum profiles necessary for proper security. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQPROC ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQPROC DENY-BY-DEFAULT PROFILE') RDEF MQPROC &ltssid>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED FOR ZWMQ0055') PE &ltssid>.** CL(MQPROC) ID(&ltApplicableUsers>) SETR RACL(MQPROC) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a Quequeue Managermanager Namednamed QMD1: >QMD1 REFRESH SECURITY(*) The following is a sample of the commands required to allow a group (GRP1) to inquire on processes beginning with the letter V on queue manager (QM1): RDEFINE MQPROC QM1.V* UACC(NONE) AUDIT(ALL(READ)) PERMIT QM1.V* CLASS(MQPROC) ID(GRP1) ACCESS(READ)

V-224562 in V7R3

Check text

a) Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQNLIST). b)- SENSITVE.RPT(MXNLIST). For all namelist resources (i.e., ssid.namelist) defined to the MQNLIST, and GMQNLIST, MXNLIST,resource class (or MXNLIST and GMXNLIST resource classes, ensureif SCYCASE is set to MIXED). If the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (ia.ek.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to make namelist inquiresinquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. c) If both of the items in (b) are true, this is not a finding. d) If either item in (b) is untrue, this is a finding.

Fix text

A namelist is a MQSeries/WebSphere MQ object that contains a list of queue names. Namelist security validates userids authorized to inquire on namelists. Namelist security will be active, and all profiles ssid.namelist will be defined to the MQNLIST, GMQNLIST, MXNLIST, or GMXNLIST classes with UACC(NONE) specified. Restrict readREAD access to those userids requiring access to make namelist inquiries. For all namelist resources (i.e., ssid.namelist) defined to the MQNLIST, GMQNLIST, MXNLIST, or GMXNLIST resource classes, ensure the following items are in effect: NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to make namelist inquires. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. A set of sample commands are provided below to implement the minimum profiles necessary for proper security. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQNLIST ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE') RDEF MQNLIST &ltssid>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('REQUIRED FOR ZWMQ0056') PE &ltssid>.** CL(MQNLIST) ID(&ltapplicable>) SETR RACL(MQNLIST) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager named QMD1: >QMD1 REFRESH SECURITY(*)

V-224563 in V7R3

Check text

a) Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQADMIN). b)- SENSITVE.RPT(MXADMIN). For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classclasses, ensureif SCYCASE is set to MIXED). If the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. c) If both of the items in (b) are true, there is no finding. d) If either item in (b) is untrue, this is a finding.

Fix text

Alternate userid security allows access to be requested under another userid. Alternate userid security will be active, and all profiles ssid.ALTERNATE.USER.alternateuserid will be defined to the MQADMIN or MXADMIN class with UACC(NONE) specified. Restrict updateUPDATE access to those userids requiring access to alternate userids. For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to the MQADMIN or MXADMIN resource class, ensure the following items are in effect: NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. A set of sample commands are provided below to implement the minimum profiles necessary for proper security. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQADMIN ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT PROFILE') RDEF MQADMIN &ltssid>.ALTERNATE.USER.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT for ALT USER PROFILE') The following is a sample of the commands required to allow payroll server (PAYSRV1) to specify alternate userids starting with the characters PS on queue manager (QM1): RDEFINE MQADMIN QMD1.ALTERNATE.USER.PS* UACC(NONE) AUDIT(ALL) PERMIT QMD1.ALTERNATE.USER.PS* CLASS(MQADMIN) ID(PAYSRV1) ACCESS(UPDATE) SETR RACL(MQADMIN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager named QMD1: >QMD1 REFRESH SECURITY(*)

V-224564 in V7R3

Check text

a) Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQADMIN). b)- SENSITVE.RPT(MXADMIN). For all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classclasses, ensureif SCYCASE is set to MIXED). If the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. c) If both of the items in (b) are true, there is no finding. d) If either item in (b) is untrue, this is a finding.

Fix text

Context security validates whether a userid has authority to pass or set identity and/or origin data for a message. Context security will be active, and all profiles ssid.CONTEXT will be defined to the appropriate ADMIN class with UACC(NONE) specified, where ssid is the queue manager name. ReadREAD access is required when the PASS option is specified for an MQOPEN or MQPUT1. Update or control access is required when the SET or OUTPUT option is specified. For all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN or MXADMIN resource class, ensure the following items are in effect: NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. A set of sample commands are provided below to implement the minimum profiles necessary for proper security. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQADMIN ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN DENY-BY-DEFAULT PROFILE') RDEF MQADMIN &ltssid>.CONTEXT UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN PROFILE REQUIRED FOR CONTEXT SECURITY') The following is a sample of the commands required to allow a systems programming group (SYS1) to offload and reload messages for queue manager (QMD1): PERMIT QMD1.CONTEXT CLASS(MQADMIN) ID(SYS1) ACCESS(CONTROL) The following refresh is required for RACListed classes: SETR RACL(MQADMIN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager named QMD1: >QMD1 REFRESH SECURITY(*)

V-224565 in V7R3

Check text

a) Refer to the following reports produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(MQCMDS). b) For all command resources (i.e., ssid.command) defined to the MQCMDS and GMQCMDS resource class,classes. ensureIf the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to the appropriate personnel as designated in the WebsphereWebSphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum. 3) All command access is logged as designated in the WebsphereWebScphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum. c) If all of the items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.

Fix text

Command security validates userids authorized to issue MQSeries / WebSphere MQ commands. Command security will be active For all command resources (i.e., ssid.command) defined to the MQCMDS resource class, ensure the following items are in effect: NOTE 1: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Resource profiles are defined with a UACC(NONE). 2) Access authorization restricts access to the appropriate personnel as designated in the table entitledtitled "Websphere MQ Command Security Controls " in the zOS STIG Addendum. 3) All command access is logged as designated in the table entitledtitled "Websphere MQ Command Security Controls" in the zOS STIG Addendum. A set of sample commands are provided below to implement the minimum profiles necessary for proper security. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQCMDS ** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCMDS DENY-BY-DEFAULT PROFILE') RDEF MQCMDSN &ltssid>.&ltCmdName>.** UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQCMDS Required See ZWMQ0059') PE &ltssid>.&ltCmdNAme>.** CL(MQCMDS) ID(&ltautherizeduserltauthorizeduser>) ACC(C) SETR RACL(MQCMDS) REF Note that an additional WebSphere MQ Refresh may be required for active Qmanagers. This is done from the CONSOLE: The example is for a Quequeue Managermanager Namednamed QMD1: >QMD1 REFRESH SECURITY(*)

Discussion

WebSphere MQ resources allow for the control of commands. Failure to properly protect WebSphere MQ Command resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

V-224566 in V7R3

Check text

a) Refer to the following reports produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(MQADMIN). - SENSITVE.RPT(MXADMIN). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZWMQ0060). bReview the MQADMIN and GMQADMIN resource classes (or MXADMIN and GMXADMIN resource classes, if SCYCASE is set to MIXED). EnsureIf the following itemsguidance areis intrue, effect:this is not a finding. NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) A RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to the MQADMIN or MXADMIN resource class with a UACC(NONE). 2) Access authorization to these RESLEVEL resources restricts all access. No users or groups must be specified in the access list. c) If both of the items in (b) are true, there is no finding. d) If either item in (b) is untrue, this is a finding.

Fix text

RESLEVEL security profiles control the number of userids checked for API-resource security. RESLEVEL security will not be implemented due to the following exposures and limitations: 1) RESLEVEL is a powerful option that can cause the bypassing of all security checks. 2) Security audit records are not created when the RESLEVEL profile is utilized. 3) If the WARNING option is specified on a RESLEVEL profile, no warning messages are produced. To protect against any profile in the MQADMIN or MXADMIN class, such as ssid.**, resolving to a RESLEVEL profile, a ssid.RESLEVEL profile will be defined for each queue manager with UACC(NONE) specified and no users or groups specified in the access list. Ensure the following items are in effect: NOTENote: ssid is the queue manager name (a.k.a., subsystem identifier). 1) A RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to the MQADMIN or MXADMIN resource class with a UACC(NONE). 2) Access authorization to these RESLEVEL resources restricts all access. No users or groups must be specified in the access list. A set of sample commands is provided below to implement the profile necessary for proper security. RDEF MQADMIN &ltssid>.RESLEVEL UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) DATA('MQADMIN PROFILE REQUIRED BY ZWMQ0060') SETR RACL(MQADMIN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager named QMD1: >QMD1 REFRESH SECURITY(*)

V-224567 in V7R3