The system programmer will ensure that the CONSOLxx members are properly configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7485	ACP00291	SV-7923r2_rule	DCCS-1 DCCS-2	Medium

Description
MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

STIG	Date
z/OS RACF STIG	2016-06-30

Details

Check Text ( C-21313r1_chk )
Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PARMLIB) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ACP00291) Review each CONSOLxx parmlib member, ensure the following items are in effect. ____ The DEFAULT statement for each CONSOLxx member specifies LOGON(REQUIRED) or LOGON(AUTO). ____ The CONSOLE statement for each console assigns a unique name using the NAME parameter. ____ The CONSOLE statement for each console specifies AUTH(INFO). Exceptions are the AUTH parameter is not valid for consoles defined with UNIT(PRT) and specifying AUTH(MASTER) is permissible for the system console.

Check Text ( C-21313r1_chk )

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PARMLIB)

Automated Analysis
Refer to the following report produced by the z/OS Data Collection:

- PDI(ACP00291)

Review each CONSOLxx parmlib member, ensure the following items are in effect.

____ The DEFAULT statement for each CONSOLxx member specifies LOGON(REQUIRED) or LOGON(AUTO).

____ The CONSOLE statement for each console assigns a unique name using the NAME parameter.

____ The CONSOLE statement for each console specifies AUTH(INFO). Exceptions are the AUTH parameter is not valid for consoles defined with UNIT(PRT) and specifying AUTH(MASTER) is permissible for the system console.

Fix Text (F-3247r1_fix)
The Systems programmer should use the following recommendations and techniques to provide protection for MCS consoles: Ensure that the DEFAULT statement specifies LOGON(REQUIRED) so that all operators are required to log on prior to entering z/OS system commands. At the discretion of the IAO, LOGON(AUTO) may be used. Ensure that each CONSOLE statement specifies an explicit console NAME. And that AUTH(INFO) is specified, this also including extended MCS consoles. AUTH(MASTER) may be specified for systems console.

Fix Text (F-3247r1_fix)

The Systems programmer should use the following recommendations and techniques to provide protection for MCS consoles:

Ensure that the DEFAULT statement specifies LOGON(REQUIRED) so that all operators are required to log on prior to entering z/OS system commands. At the discretion of the IAO, LOGON(AUTO) may be used.

Ensure that each CONSOLE statement specifies an explicit console NAME. And that AUTH(INFO) is specified, this also including extended MCS consoles. AUTH(MASTER) may be specified for systems console.