Ensure that the SETROPTS PROTECTALL value is set to FAIL

높음레벨 1수동 검토ibm-z

설명

When PROTECTALL processing is active and set to FAIL, the system automatically rejects any request to create or access a data set that is not RACF-protected. This includes DASD data sets, tape data sets, catalogs, and GDG base names. Temporary data sets that comply with standard MVS temporary data set naming conventions are excluded from PROTECTALL processing.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Issue the following TSO command: SETROPTS LIST Verify the following messages are present: PROTECT-ALL IS ACTIVE, CURRENT OPTIONS: PROTECT-ALL FAIL OPTION IS IN EFFECT Alternatively, if IBM Health Checker for z/OS is installed and active, you can request the HZSPRINT output for: CHECK(IBMRACF,RACF_PROTECTALL_FAIL) Verify the following message is present: IRRH332I SETROPTS PROTECTALL(FAIL) is in effect.

조치 방법

조치 방식: 가이드 또는 인프라 패치

To modify the PROTECTALL parameter use the RACF SETROPTS command: SETROPTS PROTECTALL(FAILURES)

속성

운영 체제: 모두
태그: ibm-zhardening
참고 자료: CIS IBM z/OS with RACF Benchmark v1.0.0 - 2.3.3 Ensure that the SETROPTS PROTECTALL value is set to FAIL