Ensure that the STARTED resource class is used to assign user IDs with proper parameters to FTP server started tasks

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that STARTED appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that STARTED appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that STARTED appears. Request the following DSMON report: FUNCTION SYSTEM RACSPT Verify that the FTP Server daemon started task(s) appear in the FROM PROFILES IN THE STARTED CLASS: section and not the FROM THE STARTED PROCEDURES TABLE (ICHRIN03): section. Use ... (full steps: CIS section 6.2.1)

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To activate the STARTED class use the RACF SETROPTS command: SETROPTS CLASSACT(STARTED) To enable generic profile checking for the STARTED class use the RACF SETROPTS command: SETROPTS GENERIC(STARTED) To RACLIST the STARTED class use the RACF SETROPTS command: SETROPTS RACLIST(STARTED) To create a STARTED profile use the RACF RDEFINE and SETROPTS commands: RDEFINE STARTED FTPD*.* + UACC(NONE) + DATA('FTP SERVER DAEMON') + STDATA( + USER(<ftpd-user>) + GROUP(<ftpd-group>) + ) SETROPTS REFRESH RACLIST(STARTED) To make a user ID PROTECTED use the RACF ALTUSER command: ALTUSER <ftpd-id> + NOPASSWORD + NOPHRASE + NOOIDCARD To modify the OMVS segment for a user ID use the RACF ALTUSER command: ALTUSER <ftpd-id> + OMVS( + UID(0) + HOME('/') + PROGRAM('/bin/sh') + ) Notes: 1. If the security administrator has defined the SHARED.IDS profile in the UNIXPRIV class, the UID value must be unique. Use the SHARED keyword in addition to UID to assign a value that is already in use. 2. OMVS DIRECTORY and PROGRAM values are case sensitive, so be sure they are entered as-is and not translated to upper case.