The Syslog daemon must be defined properly.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3243	ISLG0020	SV-7080r3_rule	DCCS-1 DCCS-2 DCFA-1	Medium

Description
The Syslog daemon, known as syslogd, is a zOS UNIX daemon that provides a central processing point for log messages issued by other zOS UNIX processes. It is also possible to receive log messages from other network-connected hosts. Some of the IBM Communications Server components that may send messages to syslog are the FTP, TFTP, zOS UNIX Telnet, DNS, and DHCP servers. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. Primarily because of the potential to use this information in an audit process, there is a security interest in protecting the syslogd process and its associated data. The Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the Syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.

Description

The Syslog daemon, known as syslogd, is a zOS UNIX daemon that provides a central processing point for log messages issued by other zOS UNIX processes. It is also possible to receive log messages from other network-connected hosts. Some of the IBM Communications Server components that may send messages to syslog are the FTP, TFTP, zOS UNIX Telnet, DNS, and DHCP servers. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. Primarily because of the potential to use this information in an audit process, there is a security interest in protecting the syslogd process and its associated data. The Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the Syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.

STIG	Date
z/OS TSS STIG	2015-03-27

Details

Check Text ( C-46987r3_chk )
Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS) - TSSCMDS.RPT(OMVSUSER) Refer to the following report produced by the UNIX System Services Data Collection: - USSCMDS.RPT(ERC) - Refer to this report if the Syslog daemon is started from /etc/rc. Refer to the JCL procedure libraries defined to JES2. Ensure that the Syslog daemon is properly defined and protected as stated below. If the following guidance is true, this is not a finding. ___ The Syslog daemon userid is SYSLOGD. ___ The SYSLOGD userid has the STC facility. ___ The SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment. ___ The SYSLOGD started proc is assigned the SYSLOGD userid is in the Started Task Table. ___ If Syslog daemon is started from /etc/rc then ensure that the _BPX_JOBNAME and _BPX_USERID environment variables are assigned a value of SYSLOGD.

Check Text ( C-46987r3_chk )

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACIDS)
- TSSCMDS.RPT(OMVSUSER)

Refer to the following report produced by the UNIX System Services Data Collection:

- USSCMDS.RPT(ERC) - Refer to this report if the Syslog daemon is started from /etc/rc.

Refer to the JCL procedure libraries defined to JES2.

Ensure that the Syslog daemon is properly defined and protected as stated below. If the following guidance is true, this is not a finding.

___ The Syslog daemon userid is SYSLOGD.
___ The SYSLOGD userid has the STC facility.
___ The SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment.
___ The SYSLOGD started proc is assigned the SYSLOGD userid is in the Started Task Table.
___ If Syslog daemon is started from /etc/rc then ensure that the _BPX_JOBNAME and _BPX_USERID environment variables are assigned a value of SYSLOGD.

Fix Text (F-18687r4_fix)
The IAO working with the systems programmer responsible for supporting IBM Comm Server will ensure that Syslog daemon runs under its own user account. Specifically, it does not share the account defined for the z/OS UNIX kernel. The Syslog daemon userid is SYSLOGD. The SYSLOGD userid has the STC facility. The SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment. To set up and use as an MVS Started Proc, the following sample commands are provided: TSS CREATE(SYSLOGD) TYPE(USER) NAME(SYSLOGD) – DEPT(existing-dept) FACILITY(STC) – PASSWORD(password,0) TSS ADD(SYSLOGD) DFLTGRP(stctcpx) GROUP(stctcpx) TSS ADD(SYSLOGD) SOURCE(INTRDR) TSS ADD(SYSLOGD) UID(0) HOME(/) OMVSPGM(/bin/sh) The SYSLOGD started proc is assigned the SYSLOGD userid is in the Started Task Table. TSS ADD(STC) PROCNAME(SYSLOGD) ACID(SYSLOGD) If /etc/rc is used to start the Syslog daemon ensure that the _BPX_JOBNAME and _BPX_ USERID environment variables are assigned a value of SYSLOGD.

Fix Text (F-18687r4_fix)

The IAO working with the systems programmer responsible for supporting IBM Comm Server will ensure that Syslog daemon runs under its own user account. Specifically, it does not share the account defined for the z/OS UNIX kernel.

The Syslog daemon userid is SYSLOGD.
The SYSLOGD userid has the STC facility.
The SYSLOGD userid has UID(0), HOME(‘/’), and PROGRAM(‘/bin/sh’) specified in the OMVS segment.

To set up and use as an MVS Started Proc, the following sample commands are provided:

TSS CREATE(SYSLOGD) TYPE(USER) NAME(SYSLOGD) –
DEPT(existing-dept) FACILITY(STC) –
PASSWORD(password,0)
TSS ADD(SYSLOGD) DFLTGRP(stctcpx) GROUP(stctcpx)
TSS ADD(SYSLOGD) SOURCE(INTRDR)
TSS ADD(SYSLOGD) UID(0) HOME(/) OMVSPGM(/bin/sh)

The SYSLOGD started proc is assigned the SYSLOGD userid is in the Started Task Table.

TSS ADD(STC) PROCNAME(SYSLOGD) ACID(SYSLOGD)

If /etc/rc is used to start the Syslog daemon ensure that the _BPX_JOBNAME and _BPX_ USERID environment variables are assigned a value of SYSLOGD.