The startup parameters for the FTP include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords. The FTP daemon’s started task JCL does not specify the SYSTCPD and SYSFTPD DD statements for configuration files.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3234	IFTP0020	SV-3234r2_rule	DCCS-1 DCCS-2 IAIA-1 IAIA-2	Medium

Description
During initialization, the FTP daemon reads JCL keywords and configuration files to determine values for critical operational parameters. Because system security is impacted by some of these parameter settings, controlling these options through the configuration file only and explicitly specifying the file locations reduces ambiguity, enhances security auditing, and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.

Description

During initialization, the FTP daemon reads JCL keywords and configuration files to determine values for critical operational parameters. Because system security is impacted by some of these parameter settings, controlling these options through the configuration file only and explicitly specifying the file locations reduces ambiguity, enhances security auditing, and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.

STIG	Date
z/OS ACF2 STIG	2016-01-04

Details

Check Text ( C-20505r1_chk )
a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the FTP daemon. If FTP is inactive, review the procedure libraries defined to JES2 and locate the FTP JCL member. NOTE: The JCL member is typically named FTPD. Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL. Automated Analysis Refer to the following report produced by the IBM Communications Server Data Collection: - PDI(IFTP0020) b) Ensure the following items are in effect for the FTP daemon’s started task JCL: 1) The SYSTCPD and SYSFTPD DD statements specify the TCP/IP Data and FTP Data configuration files respectively. 2) The ANONYMOUS keyword is not coded on the PARM parameter on the EXEC statement. 3) The ANONYMOUS=logonid combination is not coded on the PARM parameter on the EXEC statement. 4) The INACTIVE keyword is not coded on the PARM parameter on the EXEC statement. c) The AUTOLOG statement block can be configured to have TCP/IP start the FTP Server. The FTP entry (e.g., FTPD) can include the PARMSTRING parameter to pass parameters to the FTP procedure when started. NOTE: Parameters passed on the PARMSTRING parameter override parameters specified in the FTP procedure. If an FTP entry is configured in the AUTOLOG statement block in the TCP/IP Profile configuration file, ensure the following items are in effect: 1) The ANONYMOUS keyword is not coded on the PARMSTRING parameter. 2) The ANONYMOUS=logonid combination is not coded on the PARMSTRING parameter. 3) The INACTIVE keyword is not coded on PARMSTRING parameter. d) If all of the items in (b) and (c) are true, there is NO FINDING. e) If any item in (b) or (c) is untrue, this is a FINDING.

Check Text ( C-20505r1_chk )

a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the FTP daemon.

If FTP is inactive, review the procedure libraries defined to JES2 and locate the FTP JCL member.

NOTE: The JCL member is typically named FTPD.

Refer to the Profile configuration file specified on the PROFILE DD statement in the TCPIP started task JCL.

Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:

- PDI(IFTP0020)

b) Ensure the following items are in effect for the FTP daemon’s started task JCL:

1) The SYSTCPD and SYSFTPD DD statements specify the TCP/IP Data and FTP Data configuration files respectively.
2) The ANONYMOUS keyword is not coded on the PARM parameter on the EXEC statement.
3) The ANONYMOUS=logonid combination is not coded on the PARM parameter on the EXEC statement.
4) The INACTIVE keyword is not coded on the PARM parameter on the EXEC statement.

c) The AUTOLOG statement block can be configured to have TCP/IP start the FTP Server. The FTP entry (e.g., FTPD) can include the PARMSTRING parameter to pass parameters to the FTP procedure when started.

NOTE: Parameters passed on the PARMSTRING parameter override parameters specified in the FTP procedure.

If an FTP entry is configured in the AUTOLOG statement block in the TCP/IP Profile configuration file, ensure the following items are in effect:

1) The ANONYMOUS keyword is not coded on the PARMSTRING parameter.
2) The ANONYMOUS=logonid combination is not coded on the PARMSTRING parameter.
3) The INACTIVE keyword is not coded on PARMSTRING parameter.

d) If all of the items in (b) and (c) are true, there is NO FINDING.

e) If any item in (b) or (c) is untrue, this is a FINDING.

Fix Text (F-18150r1_fix)
Review the FTP daemon’s started task JCL. Ensure that the ANONYMOUS and INACTIVE startup parameters are not specified and configuration file names are specified on the appropriate DD statements. The FTP daemon program can accept parameters in the JCL procedure that is used to start the daemon. The ANONYMOUS and ANONYMOUS= keywords are designed to allow anonymous FTP connections. The INACTIVE keyword is designed to set the timeout value for inactive connections. Control of these options is recommended through the configuration file statements rather than the startup parameters. The systems programmer responsible for supporting ICS will ensure that the startup parameters for the FTP daemon does not include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords. During initialization the FTP daemon searches multiple locations for the TCPIP.DATA and FTP.DATA files according to fixed sequences. In the daemon’s started task JCL, Data Definition (DD) statements will be used to specify the locations of the files. The SYSTCPD DD statement identifies the TCPIP.DATA file and the SYSFTPD DD statement identifies the FTP.DATA file. The systems programmer responsible for supporting ICS will ensure that the FTP daemon’s started task JCL specifies the SYSTCPD and SYSFTPD DD statements for configuration files.

Fix Text (F-18150r1_fix)

Review the FTP daemon’s started task JCL. Ensure that the ANONYMOUS and INACTIVE startup parameters are not specified and configuration file names are specified on the appropriate DD statements.

The FTP daemon program can accept parameters in the JCL procedure that is used to start the daemon. The ANONYMOUS and ANONYMOUS= keywords are designed to allow anonymous FTP connections. The INACTIVE keyword is designed to set the timeout value for inactive connections. Control of these options is recommended through the configuration file statements rather than the startup parameters.

The systems programmer responsible for supporting ICS will ensure that the startup parameters for the FTP daemon does not include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords.

During initialization the FTP daemon searches multiple locations for the TCPIP.DATA and FTP.DATA files according to fixed sequences. In the daemon’s started task JCL, Data Definition (DD) statements will be used to specify the locations of the files. The SYSTCPD DD statement identifies the TCPIP.DATA file and the SYSFTPD DD statement identifies the FTP.DATA file.

The systems programmer responsible for supporting ICS will ensure that the FTP daemon’s started task JCL specifies the SYSTCPD and SYSFTPD DD statements for configuration files.