Configuration files for the TCP/IP stack are not properly specified.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3215	ITCP0010	SV-3215r2_rule	DCCS-1 DCCS-2	Medium

Description
The TCP/IP stack reads two configuration files to determine values for critical operational parameters. These file names are specified in multiple locations and, depending on the process, are referenced differently. Because system security is impacted by some of the parameter settings, specifying the file names explicitly in each location reduces ambiguity and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.

Description

The TCP/IP stack reads two configuration files to determine values for critical operational parameters. These file names are specified in multiple locations and, depending on the process, are referenced differently. Because system security is impacted by some of the parameter settings, specifying the file names explicitly in each location reduces ambiguity and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.

STIG	Date
z/OS RACF STIG	2015-06-24

Details

Check Text ( C-20025r1_chk )
a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the TCPIP started task. If TCPIP is inactive, review the procedure libraries defined to JES2 and locate the TCPIP JCL member. Automated Analysis Refer to the following report produced by the IBM Communications Server Data Collection: - PDI(ITCP0010) b) Ensure the following items are in effect for the TCPIP started task JCL: 1) The PROFILE and SYSTCPD DD statements specify the TCP/IP Profile and Data configuration files respectively. 2) The RESOLVER_CONFIG variable on the EXEC statement is set to the same file name specified on the SYSTCPD DD statement. c) If both of the above are true, there is NO FINDING. d) If either of the above is untrue, this is a FINDING.

Check Text ( C-20025r1_chk )

a) Display the active started tasks executing on the domain using SDSF, or equivalent JES display product, and locate the TCPIP started task.

If TCPIP is inactive, review the procedure libraries defined to JES2 and locate the TCPIP JCL member.

Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:

- PDI(ITCP0010)

b) Ensure the following items are in effect for the TCPIP started task JCL:

1) The PROFILE and SYSTCPD DD statements specify the TCP/IP Profile and Data configuration files respectively.
2) The RESOLVER_CONFIG variable on the EXEC statement is set to the same file name specified on the SYSTCPD DD statement.

c) If both of the above are true, there is NO FINDING.

d) If either of the above is untrue, this is a FINDING.

Fix Text (F-18175r1_fix)
Review the TCP/IP started task JCL to ensure the configuration file names are specified on the appropriate DD statements and parameter option. During initialization the TCP/IP stack uses fixed search sequences to locate the PROFILE.TCPIP and TCPIP.DATA files. However, uncertainty is reduced and security auditing is enhanced by explicitly specifying the locations of the files. In the TCP/IP started task’s JCL, Data Definition (DD) statements can be used to specify the locations of the files. The PROFILE DD statement identifies the PROFILE.TCPIP file and the SYSTCPD DD statement identifies the TCPIP.DATA file. The location of the TCPIP.DATA file can also be specified by coding the RESOLVER_CONFIG environment variable as a parameter of the ENVAR option in the TCP/IP started task’s JCL. In fact, the value of this variable is checked before the SYSTCPD DD statement by some processes. However, not all processes (e.g., TN3270 Telnet Server) will access the variable to get the file location. Therefore specifying the file location explicitly, both on a DD statement and through the RESOLVER_CONFIG environment variable, reduces ambiguity. The systems programmer responsible for supporting ICS will ensure that the TCP/IP started task’s JCL specifies the PROFILE and SYSTCPD DD statements for the PROFILE.TCPIP and TCPIP.DATA configuration files and TCP/IP started task’s JCL includes the RESOLVER_CONFIG variable, set to the name of the file specified on the SYSTCPD DD statement.

Fix Text (F-18175r1_fix)

Review the TCP/IP started task JCL to ensure the configuration file names are specified on the appropriate DD statements and parameter option.

During initialization the TCP/IP stack uses fixed search sequences to locate the PROFILE.TCPIP and TCPIP.DATA files. However, uncertainty is reduced and security auditing is enhanced by explicitly specifying the locations of the files. In the TCP/IP started task’s JCL, Data Definition (DD) statements can be used to specify the locations of the files. The PROFILE DD statement identifies the PROFILE.TCPIP file and the SYSTCPD DD statement identifies the TCPIP.DATA file.

The location of the TCPIP.DATA file can also be specified by coding the RESOLVER_CONFIG environment variable as a parameter of the ENVAR option in the TCP/IP started task’s JCL. In fact, the value of this variable is checked before the SYSTCPD DD statement by some processes. However, not all processes (e.g., TN3270 Telnet Server) will access the variable to get the file location. Therefore specifying the file location explicitly, both on a DD statement and through the RESOLVER_CONFIG environment variable, reduces ambiguity.
The systems programmer responsible for supporting ICS will ensure that the TCP/IP started task’s JCL specifies the PROFILE and SYSTCPD DD statements for the PROFILE.TCPIP and TCPIP.DATA configuration files and TCP/IP started task’s JCL includes the RESOLVER_CONFIG variable, set to the name of the file specified on the SYSTCPD DD statement.