UCF STIG Viewer Logo

ACF2 TSOCRT GSO record values must be set to obliterate the logon to ASCII CRT devices.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223510 ACF2-ES-000930 SV-223510r533198_rule Medium
Description
To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the operating system must not provide any information allowing an unauthorized user to compromise the authentication mechanism. Obfuscation of user-provided information that is typed into the system is a method used when addressing this risk. Displaying asterisks when a user types in a password is an example of obscuring feedback of authentication information.
STIG Date
IBM z/OS ACF2 Security Technical Implementation Guide 2022-01-05

Details

Check Text ( C-25183r500663_chk )
From the ISPF Command Shell enter:
ACF
SET CONTROL(GSO)
LIST TSOCRT

If the GSO TSOCRT record values conform to the following requirements, this is not a finding.

STRING(A12FA11C1A270C0D)
Fix Text (F-25171r500664_fix)
Define a clear string used to obliterate the logon to ASCII CRT devices.

STRING(A12FA11C1A270C0D)

Example:
SET C(GSO)
INSERT TSOCRT STRING(A12FA11C1A270C0D)

F ACF2,REFRESH(TSOCRT)