UCF STIG Viewer Logo

IBM RACF SETROPTS LOGOPTIONS must be properly configured.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223653 RACF-ES-000050 SV-223653r868792_rule Medium
Description
Once an attacker establishes access to a system, the attacker often attempts to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create an account. Auditing account creation actions provides logging that can be used for forensic purposes. To address access requirements, many operating systems may be integrated with enterprise level authentication/access/auditing mechanisms that meet or exceed access control policy requirements. Satisfies: SRG-OS-000004-GPOS-00004, SRG-OS-000038-GPOS-00016, SRG-OS-000039-GPOS-00017, SRG-OS-000040-GPOS-00018, SRG-OS-000041-GPOS-00019, SRG-OS-000042-GPOS-00021, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000392-GPOS-00172, SRG-OS-000458-GPOS-00203, SRG-OS-000461-GPOS-00205, SRG-OS-000462-GPOS-00206, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000466-GPOS-00210, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000471-GPOS-00216, SRG-OS-000472-GPOS-00217, SRG-OS-000473-GPOS-00218, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220, SRG-OS-000476-GPOS-00221, SRG-OS-000477-GPOS-00222
STIG Date
IBM z/OS RACF Security Technical Implementation Guide 2022-12-14

Details

Check Text ( C-25326r868790_chk )
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:

Verify that the following LOGOPTIONS are specified:
LOGOPTIONS "FAILURES" CLASSES =
LOGOPTIONS "NEVER" CLASSES = NONE

The other LOGOPTIONS may be site determined.

If the LOGOPTIONS are not set as described above, this is a finding.
Fix Text (F-25314r868791_fix)
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option as specified in the example below:

Ensure that the following LOGOPTIONS are specified:
LOGOPTIONS "FAILURES" CLASSES =
LOGOPTIONS "NEVER" CLASSES = NONE

The other LOGOPTIONS may be site determined.