Interactive LOGONIDs defined to ACF2 must have the required fields completed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-159	ACF0570	SV-159r5_rule	DCCS-1 DCCS-2	Medium

Description
Improper assignments of attributes in the LOGONID record may allow users excessive privileges resulting in unauthorized access.

STIG	Date
z/OS ACF2 STIG	2019-12-12

Details

Check Text ( C-241r6_chk )
Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(TSOUSERS) - ACF2CMDS.RPT(MAXDAYS0) - ACF2CMDS.RPT(MAXDAYS) - ACF2CMDS.RPT(MINDAYS) Automated Analysis Refer to the following report produced by the ACF2 Data Collection Checklist: - PDI(ACF0570) Verify that the interactive userids are properly defined. If the following guidance is true, this is not a finding. ___ Ensure that all logonid record fields for interactive users are specified as in the table entitled INTERACTIVE USERS - ACF2, in the z/OS STIG Addendum. ___ Ensure that MAXDAYS is a value of 1 to 60 days. Note: Current DoD policy has changed requiring that the password change interval is set to a value of 1 to 60. Ensure that this is in effect. Note: FTP only process and server to server userids may have MAXDAYS(0) and LIDZMAX specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis.

Check Text ( C-241r6_chk )

Refer to the following reports produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(TSOUSERS)
- ACF2CMDS.RPT(MAXDAYS0)
- ACF2CMDS.RPT(MAXDAYS)
- ACF2CMDS.RPT(MINDAYS)

Automated Analysis
Refer to the following report produced by the ACF2 Data Collection Checklist:

- PDI(ACF0570)

Verify that the interactive userids are properly defined. If the following guidance is true, this is not a finding.

___ Ensure that all logonid record fields for interactive users are specified as in the table entitled INTERACTIVE USERS - ACF2, in the z/OS STIG Addendum.

___ Ensure that MAXDAYS is a value of 1 to 60 days.

Note: Current DoD policy has changed requiring that the password change interval is set to a value of 1 to 60. Ensure that this is in effect.

Note: FTP only process and server to server userids may have MAXDAYS(0) and LIDZMAX specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis.

Fix Text (F-27326r5_fix)
The IAO will review all interactive LOGONID records to ensure required information is provided. Evaluate the impact of correcting any deficiencies. Develop a plan of action and implement the required changes. Review all LOGONID definitions to ensure required information is provided as in the table entitled INTERACTIVE USERS - ACF2, in the zOS STIG Addendum. Note: Current DoD policy has changed requiring that the password change interval is set to a value of 1 to 60. Ensure that this is in effect. Note: FTP only process and server to server userids may have MAXDAYS(0) and LIDZMAX specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis. Example: SET LID INSERT logonid UID(uid string) NAME(user name) AUTHSUP1 MAXDAYS(60) MINDAYS(1)

Fix Text (F-27326r5_fix)

The IAO will review all interactive LOGONID records to ensure required information is provided. Evaluate the impact of correcting any deficiencies. Develop a plan of action and implement the required changes.

Review all LOGONID definitions to ensure required information is provided as in the table entitled INTERACTIVE USERS - ACF2, in the zOS STIG Addendum.

Note: Current DoD policy has changed requiring that the password change interval is set to a value of 1 to 60. Ensure that this is in effect.

Note: FTP only process and server to server userids may have MAXDAYS(0) and LIDZMAX specified. These users must be identified in the FTPUSERS group in the Dialog Process or FTP in the name field. Additionally, these users must change their passwords on an annual basis.

Example:

SET LID
INSERT logonid UID(uid string) NAME(user name) AUTHSUP1 MAXDAYS(60) MINDAYS(1)