WebSphere MQ MQCONN Class resources are not protected in accordance with security.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6962	ZWMQ0052	SV-7263r2_rule	DCCS-1 DCCS-2 ECAR-1 ECAR-2 IAIA-1 IAIA-2	Medium

Description
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

STIG	Date
z/OS ACF2 STIG	2018-04-04

Details

Check Text ( C-20826r1_chk )
a) Refer to the following report produced by the ACF2 Data Collection: - SENSITVE.RPT(MQCONN) - ACF2CMDS.RPT(RESOURCE) – Alternate report b) Review the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to TYPE(MQK), ensure the following items are in effect: 1) Access authorization to these connections restricts access to the appropriate users as indicated in (b). 2) All access is logged. d) If both of the items in (c) are true, there is NO FINDING. e) If either item in (c) is untrue, this is a FINDING.

Check Text ( C-20826r1_chk )

a) Refer to the following report produced by the ACF2 Data Collection:

- SENSITVE.RPT(MQCONN)
- ACF2CMDS.RPT(RESOURCE) – Alternate report

b) Review the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class):

Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids

NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).

c) For all connection resources defined to TYPE(MQK), ensure the following items are in effect:

1) Access authorization to these connections restricts access to the appropriate users as indicated in (b).
2) All access is logged.

d) If both of the items in (c) are true, there is NO FINDING.

e) If either item in (c) is untrue, this is a FINDING.

Fix Text (F-18782r1_fix)
The IAO will ensure that all connections to MQSeries/WebSphere MQ resources are restricted using connection security. Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: Access authorization to these connections restricts access to the appropriate users as indicated above. All access is logged. Example: $KEY(ssid) TYPE(MQK) BATCH UID(STCssid) SERVICE(READ) LOG BATCH UID(syspaudt) SERVICE(READ) LOG BATCH UID() PREVENT CHIN UID(STCssidCHIN) SERVICE(READ) LOG CHIN UID() PREVENT CICS UID() PREVENT IMS UID() PREVENT

Fix Text (F-18782r1_fix)

The IAO will ensure that all connections to MQSeries/WebSphere MQ resources are restricted using connection security.

Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONN resource class):

Resource Authorized Users
ssid.BATCH TSO and batch job userids
ssid.CICS CICS region userids
ssid.IMS IMS region userids
ssid.CHIN Channel initiator userids

NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).

For all connection resources defined to TYPE(MQK), ensure the following items are in effect:

Access authorization to these connections restricts access to the appropriate users as indicated above.

All access is logged.

Example:

$KEY(ssid) TYPE(MQK)
BATCH UID(STCssid) SERVICE(READ) LOG
BATCH UID(syspaudt) SERVICE(READ) LOG
BATCH UID(*) PREVENT
CHIN UID(STCssidCHIN) SERVICE(READ) LOG
CHIN UID(*) PREVENT
CICS UID(*) PREVENT
IMS UID(*) PREVENT