RACF batch jobs are improperly secured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-286	RACF0590	SV-286r2_rule	DCCS-1 DCCS-2	Medium

Description
Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.

Description

Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.

STIG	Date
z/OS RACF STIG	2019-09-27

Details

Check Text ( C-18030r1_chk )
a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection: - RACFCMDS.RPT(SETROPTS) - SENSITVE.RPT(SURROGAT) - RACFCMDS.RPT(LISTUSER) Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids. b) If the submission of batch jobs via an automated process (e.g., job scheduler, job submission started task, etc.) is being utilized, ensure the following items are in effect: 1) The SURROGAT resource class is active. Note: This does not need to be checked, automation check is performed in ZUSSR060. 2) Each batch job userid used for batch submission by a job scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example: RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE) OWNER(execution-userid) 3) Job scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example: PERMIT execution-userid.SUBMIT CLASS(SURROGAT) ID(surrogate-userid) ACCESS(READ) c) If all of the above in (b) are true, there is NO FINDING. d) If any of the above in (b) is untrue, this is a FINDING.

Check Text ( C-18030r1_chk )

a) Refer to the following reports produced by the RACF Data Collection and Data Set and Resource Data Collection:

- RACFCMDS.RPT(SETROPTS)
- SENSITVE.RPT(SURROGAT)
- RACFCMDS.RPT(LISTUSER)

Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.

b) If the submission of batch jobs via an automated process (e.g., job scheduler, job submission started task, etc.) is being utilized, ensure the following items are in effect:

1) The SURROGAT resource class is active. Note: This does not need to be checked, automation check is performed in ZUSSR060.
2) Each batch job userid used for batch submission by a job scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example:

RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE)
OWNER(execution-userid)

3) Job scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example:

PERMIT execution-userid.SUBMIT CLASS(SURROGAT)
ID(surrogate-userid) ACCESS(READ)

c) If all of the above in (b) are true, there is NO FINDING.

d) If any of the above in (b) is untrue, this is a FINDING.

Fix Text (F-17773r1_fix)
Ensure the following: 1. Each batch job userid used for batch submission by a job scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example: RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE) OWNER(execution-userid) 2. Job scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example: PERMIT execution-userid.SUBMIT CLASS(SURROGAT) ID(surrogate-userid) ACCESS(READ)

Fix Text (F-17773r1_fix)

Ensure the following:

1. Each batch job userid used for batch submission by a job scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example:

RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE)
OWNER(execution-userid)

2. Job scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example:

PERMIT execution-userid.SUBMIT CLASS(SURROGAT)
ID(surrogate-userid) ACCESS(READ)