WebSphere MQ resource classes are not properly actived for security checking by the ACP.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6959	ZWMQ0049	SV-7534r2_rule		Medium

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

STIG	Date
z/OS RACF STIG	2019-12-12

Details

Check Text ( C-4642r1_chk )

Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) - DSMON.RPT(RACCDT) - Alternate list of active resource classes Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZWMQ0049) Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE For V7.0.0 and above: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC NOTE: If both MQADMIN and MXADMIN resource classes are not active, no security checking is performed.

Fix Text (F-6835r1_fix)

The IAO will ensure that all WebSphere MQ resources are active and properly defined. Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE For V7.0.0 and above: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC NOTE: If both MQADMIN and MXADMIN resource classes are not active, no security checking is performed. The follow sample contains commands to active the required classes: SETR CLASSACT(MQADMIN MQCMDS MQCONN) SETR CLASSACT(MQNLIST MQPROC MQQUEUE) SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)