The CBIND Resource(s) for the WebSphere Application Server is(are) not protected in accordance with security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3899	ZWAS0030	SV-3899r2_rule	DCCS-1 DCCS-2 ECCD-1 ECCD-2	Medium

Description
SAF resources provide the ability to control access to functions and services of the WebSphere Application Server (WAS) environment. Many of these resources provide operational and administrative support for WAS. Failure to properly protect these resources may lead to unauthorized access. This exposure could compromise the integrity and availability of application services and customer data.

STIG	Date
z/OS ACF2 STIG	2018-01-05

Details

Check Text ( C-20750r1_chk )
a) Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO) - SENSITVE.RPT(CBIND) b) Ensure the following items are in effect for CBIND resource protection: 2) The CLASMAP record defines the CBIND resource class. 3) The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT. 4) Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID). c) If all items in (b) are true, there is NO FINDING. e) If any item in (b) is untrue, this is a FINDING.

Check Text ( C-20750r1_chk )

a) Refer to the following reports produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO)
- SENSITVE.RPT(CBIND)

b) Ensure the following items are in effect for CBIND resource protection:

2) The CLASMAP record defines the CBIND resource class.

3) The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT.

4) Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID).

c) If all items in (b) are true, there is NO FINDING.

e) If any item in (b) is untrue, this is a FINDING.

Fix Text (F-18682r1_fix)
The IAO will ensure that the CBIND resource is defined to the ACP with an access of none. Ensure the following items are in effect for CBIND resource protection: The CLASMAP record defines the CBIND resource class. The CBIND class defaults to a generic type code of SAF. It is recommended that a GSO CLASMAP record be added to change this to a site selected resource unique to the CBIND class such as CBI. The following shows how the suggested change example would be coded: SET CONTROL(GSO) INSERT CLASMAP.cbind RESOURCE(CBIND) RSRCTYPE(cbi) -ENTITYLN(41) The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT. Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID). Example: $KEY(CB) TYPE(CBI) BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW BIND.BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW UID(*) PREVENT

Fix Text (F-18682r1_fix)

The IAO will ensure that the CBIND resource is defined to the ACP with an access of none.

Ensure the following items are in effect for CBIND resource protection:

The CLASMAP record defines the CBIND resource class.

The CBIND class defaults to a generic type code of SAF. It is recommended that a GSO CLASMAP record be added to change this to a site selected resource unique to the CBIND class such as CBI. The following shows how the suggested change example would be coded:

SET CONTROL(GSO)
INSERT CLASMAP.cbind RESOURCE(CBIND) RSRCTYPE(cbi) -ENTITYLN(41)

The CB.BIND.server_name resource is defined to the CBIND resource class with a default access of PREVENT.

Access to the CB.BIND.server_name resource is restricted to WAS server (STC) logonids and systems management logonids (e.g., WebSphere administrator ID).

Example:

$KEY(CB) TYPE(CBI)
BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW
BIND.BBOASR1 UID(was_admin_uid) SERVICE(READ) ALLOW
UID(*) PREVENT