CL/SuperSession must be properly configured to generate SMF records for audit trail and accounting reports.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224462	ZCLS0041	SV-224462r952252_rule		Medium

Description
Product configuration/parameters control the security and operational characteristics of products. If these parameter values are improperly specified, security and operational controls may be weakened. This exposure may threaten the availability of the product applications and compromise the confidentiality of customer data.

STIG	Date
z/OS CL/SuperSession for RACF Security Technical Implementation Guide	2024-02-19

Details

Check Text ( C-26139r952250_chk )
a) Version 3 of CL/SuperSession Review the member KLKINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Version 2 of CL/SuperSession Review the member KLVINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(SMFOPTS) Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession) Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0041) b) If the SMF= field specifies an SMF record number, review the SMFOPTS report to verify SMF is writing that record type. c) If SMF is writing the record number specified by SMF=, there is no finding. d) If the SMF= field does not specify an SMF record number, or SMF is not writing the record number specified by SMF=, this is a finding.

Check Text ( C-26139r952250_chk )

a)
Version 3 of CL/SuperSession
Review the member KLKINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Version 2 of CL/SuperSession
Review the member KLVINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.)

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(SMFOPTS)

Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession)
Refer to the following report produced by the z/OS Data Collection:

- PDI(ZCLS0041)

b) If the SMF= field specifies an SMF record number, review the SMFOPTS report to verify SMF is writing that record type.

c) If SMF is writing the record number specified by SMF=, there is no finding.

d) If the SMF= field does not specify an SMF record number, or SMF is not writing the record number specified by SMF=, this is a finding.

Fix Text (F-26127r952251_fix)
Ensure that the Session Manager generates SMF records for audit trail and accounting reports. To provide an audit trail of user activity in CL/SuperSession, configure the Network Accounting Facility (NAF) to require SMF recording of accounting and audit data. Accounting to the journal data set is optional at the discretion of the site. To accomplish this for version 3 of CL/Supersession, configure the following NAF startup parameters in the KLKINNAF member of the RLSPARM initialization parameter library as follows: DSNAME= dsname - Name of the NAF journal data set. Required only if the site is collecting accounting and audit data in the journal data set in addition to the SMF data. MOD - If the journal data set is used, this parameter should be set to ensure that logging data in the data set is not overwritten. SMF=nnn - SMF record number. This field is mandatory to ensure that CL/SuperSession data is always written to the SMF files.

Fix Text (F-26127r952251_fix)

Ensure that the Session Manager generates SMF records for audit trail and accounting reports.

To provide an audit trail of user activity in CL/SuperSession, configure the Network Accounting Facility (NAF) to require SMF recording of accounting and audit data. Accounting to the journal data set is optional at the discretion of the site. To accomplish this for version 3 of CL/Supersession, configure the following NAF startup parameters in the KLKINNAF member of the RLSPARM initialization parameter library as follows:

DSNAME= dsname - Name of the NAF journal data set. Required only if the site is collecting accounting and audit data in the journal data set in addition to the SMF data.

MOD - If the journal data set is used, this parameter should be set to ensure that logging data in the data set is not overwritten.

SMF=nnn - SMF record number. This field is mandatory to ensure that CL/SuperSession data is always written to the SMF files.