IBM interactive USERIDs defined to RACF must have the required fields completed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-223718	RACF-ES-000710	SV-223718r604139_rule		Medium

Description
Interactive users are considered to be users of CICS, IMS, TSO/E, NetView, or other products that support logging on at a terminal. Improper assignments of attributes in the LOGONID record for interactive users may allow users excessive privileges resulting in unauthorized access.

STIG	Date
IBM z/OS RACF Security Technical Implementation Guide	2023-06-13

Details

Check Text ( C-25391r514842_chk )
From a z/OS command screen enter: ListUser * Examine each user entry that has either TSO, CICS, ROSCOE, IMS, or any other products that support logging on at a terminal. If every user is fully identified with all of the following condition, this is not a finding. -Each interactive userid has a valid LAST-ACCESS date that does not contain the value UNKNOWN. -Each interactive userid has PASS-INTERVAL define and set to a value of 60 days. Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally these users must change their passwords on an annual basis.

Check Text ( C-25391r514842_chk )

From a z/OS command screen enter:
ListUser *

Examine each user entry that has either TSO, CICS, ROSCOE, IMS, or any other products that support logging on at a terminal.

If every user is fully identified with all of the following condition, this is not a finding.

-Each interactive userid has a valid LAST-ACCESS date that does not contain the value UNKNOWN.
-Each interactive userid has PASS-INTERVAL define and set to a value of 60 days.

Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally these users must change their passwords on an annual basis.

Fix Text (F-25379r514843_fix)
Review all interactive USERID definitions to ensure required information is provided. Evaluate the impact of correcting any deficiencies. Develop a plan of action and implement the required changes. The PASSWORD-INTERVAL for an interactive user must be set to 60 days. Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis or less. A sample command to accomplish this is shown here: PW USER() INTERVAL(60). The LAST-ACCESS date must be set to a valid date and not to the value UNKNOWN. A sample command to accomplish this is shown here: ALU RESUME

Fix Text (F-25379r514843_fix)

Review all interactive USERID definitions to ensure required information is provided. Evaluate the impact of correcting any deficiencies. Develop a plan of action and implement the required changes.

The PASSWORD-INTERVAL for an interactive user must be set to 60 days.

Note: FTP only process and server to server userids may have PASSWORD(NOINTERVAL) specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis or less.

A sample command to accomplish this is shown here:
PW USER() INTERVAL(60).

The LAST-ACCESS date must be set to a valid date and not to the value UNKNOWN. A sample command to accomplish this is shown here:
ALU RESUME