Ensure that the STARTED resource class is used to assign user IDs with proper parameters to FTP server started tasks

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that STARTED appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that STARTED appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that STARTED appears. Request the following DSMON report: FUNCTION SYSTEM RACSPT Verify that the FTP Server daemon started task(s) appear in the FROM PROFILES IN THE STARTED CLASS: section and not the FROM THE STARTED PROCEDURES TABLE (ICHRIN03): section. Use ... (full steps: CIS section 6.2.1)

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To activate the STARTED class use the RACF SETROPTS command: SETROPTS CLASSACT(STARTED) To enable generic profile checking for the STARTED class use the RACF SETROPTS command: SETROPTS GENERIC(STARTED) To RACLIST the STARTED class use the RACF SETROPTS command: SETROPTS RACLIST(STARTED) To create a STARTED profile use the RACF RDEFINE and SETROPTS commands: RDEFINE STARTED FTPD*.* + UACC(NONE) + DATA('FTP SERVER DAEMON') + STDATA( + USER(<ftpd-user>) + GROUP(<ftpd-group>) + ) SETROPTS REFRESH RACLIST(STARTED) To make a user ID PROTECTED use the RACF ALTUSER command: ALTUSER <ftpd-id> + NOPASSWORD + NOPHRASE + NOOIDCARD To modify the OMVS segment for a user ID use the RACF ALTUSER command: ALTUSER <ftpd-id> + OMVS( + UID(0) + HOME('/') + PROGRAM('/bin/sh') + ) Notes: 1. If the security administrator has defined the SHARED.IDS profile in the UNIXPRIV class, the UID value must be unique. Use the SHARED keyword in addition to UID to assign a value that is already in use. 2. OMVS DIRECTORY and PROGRAM values are case sensitive, so be sure they are entered as-is and not translated to upper case.