Refer to the following reports produced by the TSS Data Collection:
- TSSCMDS.RPT(#STC).
- TSSCMDS.RPT(@ACIDS).
- TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values.
- TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup.
Note: The FACLIST report must be created by security personnel. The TSSPRMFL report can be used if security personnel have not executed the required steps documented in the TSS Data Collection.
Note: ssid is the queue manager name (a.k.a., subsystem identifier).
Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.
Review WebSphere MQ started tasks and ensure the following items are in effect, this is not a finding.
For ssidMSTR
FACILITY(STC, BATCH)
PASSWORD(xxxxxxxx,0)
SOURCE(INTRDR)
NOSUSPEND
MASTFAC(ssidMSTR)
For ssidCHIN
FACILITY(STC, BATCH)
PASSWORD(xxxxxxxx,0)
SOURCE(INTRDR)
NOSUSPEND
WebSphere MQ queue manager facilities is defined to the Facility Matrix Table using the following sample commands:
FAC(USERxx=NAME=ssidMSTR,MODE=FAIL,PGM=CSQ,ID=xx,ACTIVE)
FAC(ssidMSTR=SHRPRF,ASUBM,NOABEND,MULTUSER,XDEF,LUMSG)
FAC(ssidMSTR=STMSG,SIGN(S),INSTDATA,NORNDPW,AUTHINIT)
FAC(ssidMSTR=NOPROMPT,NOAUDIT,RES,WARNPW,NOTSOC)
FAC(ssidMSTR=LCFTRANS,IJU,MSGLC,NOTRACE,NOEODINIT)
FAC(ssidMSTR=NODORMPW,NONPWR)
FAC(ssidMSTR=LOG(INIT,SMF,MSG,SEC9))
FAC(ssidMSTR=DOWN=GLOBAL,LOCKTIME=00,DEFACID=(*NONE*))
Repeat these steps for each queue manager ssid.