IBM Z (z/OS)
TMA-IBM-Z-2.4.4
Ensure that the assignment of the UNIX uid(0) is justified
HighLevel 1Manual reviewibm-z
Description
RACF user IDs, groups, and started tasks that use z/OS UNIX facilities are defined to RACF with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Request reports generated using IRRDBU00 output that will allow you to: Verify That user IDs assigned UID(0) in their OMVS segment is justified.
How it is fixed
Fix method: Guidance or infrastructure patch
To modify the UID vlaue use the RACF ALTUSER command: ALTUSER <user-id> OMVS(UID(<number>))
Properties
- Operating systems
- Any
- Tags
- ibm-zaccounts
- Reference
- CIS IBM z/OS with RACF Benchmark v1.0.0 - 2.4.4 Ensure that the assignment of the UNIX uid(0) is justified