UCF STIG Viewer Logo

IBM z/OS SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223733 RACF-FT-000010 SV-223733r533199_rule Medium
Description
The FTP Server can provide audit data in the form of SMF records. The SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities. Satisfies: SRG-OS-000032-GPOS-00013, SRG-OS-000392-GPOS-00172
STIG Date
IBM z/OS RACF Security Technical Implementation Guide 2020-10-09

Details

Check Text ( C-25406r514887_chk )
If FTPDATA is configured with the following SMF statements, this is not a finding.

FTP.DATA Configuration Statements
SMF TYPE119
SMFJES TYPE119
SMFSQL TYPE119
SMFAPPE [Not coded or commented out]
SMFDEL [Not coded or commented out]
SMFEXIT [Not coded or commented out]
SMFLOGN [Not coded or commented out]
SMFREN [Not coded or commented out]
SMFRETR [Not coded or commented out]
SMFSTOR [Not coded or commented out]
Fix Text (F-25394r514888_fix)
Configure SMF options to conform to the specifications in the FTPDATA Configuration Statements below:

SMF TYPE119
SMFJES TYPE119
SMFSQL TYPE119
SMFAPPE [Not coded or commented out]
SMFDEL [Not coded or commented out]
SMFEXIT [Not coded or commented out]
SMFLOGN [Not coded or commented out]
SMFREN [Not coded or commented out]
SMFRETR [Not coded or commented out]
SMFSTOR [Not coded or commented out]

The FTP Server can provide audit data in the form of SMF records. SMF record type 119, the TCP/IP Statistics record, can be written with the following subtypes:

70 – Append
70 – Delete and Multiple Delete
72 – Invalid Logon Attempt
70 – Rename
70 – Get (Retrieve) and Multiple Get
70 – Put (Store and Store Unique) and Multiple Put

SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. This data may provide valuable information for security audit activities. Type 119 records use a more standard format and provide more information.