SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3238	IFTP0060	SV-3238r4_rule	DCCS-1 DCCS-2 ECAT-1 ECAT-2	Medium

Description
The FTP Server can provide audit data in the form of SMF records. The SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.

STIG	Date
z/OS RACF STIG	2016-06-30

Details

Check Text ( C-2761r2_chk )
Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL. Automated Analysis Refer to the following report produced by the IBM Communications Server Data Collection: - PDI(IFTP0060) Ensure the following configuration statement settings are in effect in the FTP Data configuration data set. If the following guidance is true, this is not a finding. Ensure the following items are in effect for the configuration statements specified in the FTP Data configuration file: ___ The SMF statement is coded with a value of TYPE119. ___ The SMFJES and SMFSQL statements are coded without any additional values. ___ The SMFAPPE, SMFDEL, SMFEXIT, SMFLOGN, SMFREN, SMFRETR, and SMFSTOR statements are not coded or commented out. FTP.DATA Configuration Statements SMF TYPE119 SMFJES TYPE119 SMFSQL TYPE119 SMFAPPE [Not coded or commented out] SMFDEL [Not coded or commented out] SMFEXIT [Not coded or commented out] SMFLOGN [Not coded or commented out] SMFREN [Not coded or commented out] SMFRETR [Not coded or commented out] SMFSTOR [Not coded or commented out] Note: SMF, SMFJES, and SMFSQL may be duplicated in configuration, but one of the entries must specify TYPE119.

Check Text ( C-2761r2_chk )

Refer to the Data configuration file specified on the SYSFTPD DD statement in the FTP started task JCL.

Automated Analysis
Refer to the following report produced by the IBM Communications Server Data Collection:

- PDI(IFTP0060)

Ensure the following configuration statement settings are in effect in the FTP Data configuration data set. If the following guidance is true, this is not a finding.

Ensure the following items are in effect for the configuration statements specified in the FTP Data configuration file:

___ The SMF statement is coded with a value of TYPE119.
___ The SMFJES and SMFSQL statements are coded without any additional values.
___ The SMFAPPE, SMFDEL, SMFEXIT, SMFLOGN, SMFREN, SMFRETR, and SMFSTOR statements are not coded or commented out.

FTP.DATA Configuration Statements
SMF TYPE119
SMFJES TYPE119
SMFSQL TYPE119
SMFAPPE [Not coded or commented out]
SMFDEL [Not coded or commented out]
SMFEXIT [Not coded or commented out]
SMFLOGN [Not coded or commented out]
SMFREN [Not coded or commented out]
SMFRETR [Not coded or commented out]
SMFSTOR [Not coded or commented out]

Note: SMF, SMFJES, and SMFSQL may be duplicated in configuration, but one of the entries must specify TYPE119.

Fix Text (F-18166r2_fix)
The system programmer will review the configuration statements in the FTP.DATA data set and ensure the SMF options conform to the specifications in the FTP.DATA Configuration Statements below or that they are commented out. SMF TYPE119 SMFJES TYPE119 SMFSQL TYPE119 SMFAPPE [Not coded or commented out] SMFDEL [Not coded or commented out] SMFEXIT [Not coded or commented out] SMFLOGN [Not coded or commented out] SMFREN [Not coded or commented out] SMFRETR [Not coded or commented out] SMFSTOR [Not coded or commented out] The FTP Server can provide audit data in the form of SMF records. SMF record type 119, the TCP/IP Statistics record, can be written with the following subtypes: 70 – Append 70 – Delete and Multiple Delete 72 – Invalid Logon Attempt 70 – Rename 70 – Get (Retrieve) and Multiple Get 70 – Put (Store and Store Unique) and Multiple Put SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. This data may provide valuable information for security audit activities. Type 119 records use a more standard format and provide more information.

Fix Text (F-18166r2_fix)

The system programmer will review the configuration statements in the FTP.DATA data set and ensure the SMF options conform to the specifications in the FTP.DATA Configuration Statements below or that they are commented out.

SMF TYPE119
SMFJES TYPE119
SMFSQL TYPE119
SMFAPPE [Not coded or commented out]
SMFDEL [Not coded or commented out]
SMFEXIT [Not coded or commented out]
SMFLOGN [Not coded or commented out]
SMFREN [Not coded or commented out]
SMFRETR [Not coded or commented out]
SMFSTOR [Not coded or commented out]

The FTP Server can provide audit data in the form of SMF records. SMF record type 119, the TCP/IP Statistics record, can be written with the following subtypes:

70 – Append
70 – Delete and Multiple Delete
72 – Invalid Logon Attempt
70 – Rename
70 – Get (Retrieve) and Multiple Get
70 – Put (Store and Store Unique) and Multiple Put

SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. This data may provide valuable information for security audit activities. Type 119 records use a more standard format and provide more information.