Ensure that started tasks defined with the PRIVILEGED attribute is justified

VisokaNivo 1Ručni pregledibm-z

Opis

Some started tasks require access to a broad set of resources, making it impractical to permit the started task to each of these resources individually. In these cases, the security administrator can choose between assigning the TRUSTED attribute and the PRIVILEGED attribute. A lack of logging can result in loss of visibility as to what protected resources a started task is accessing.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that STARTED appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that STARTED appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that STARTED appears. Request the following DSMON report: FUNCTION SYSTEM RACSPT Review the report and for any profiles that have YES in the PRIVILEGED column: Verify that the PRIVILEGED attribute assignment is justified. Note: Examples of PRIVILEGED ... (full steps: CIS section 2.4.5)

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To activate RACF classes use the RACF SETROPTS command: SETROPTS CLASSACT(STARTED) To enable generic profile checking for a RACF class use the RACF SETROPTS command: SETROPTS GENERIC(STARTED) To RACLIST a RACF class use the RACF SETROPTS command: SETROPTS RACLIST(STARTED) To replace PRIVILEGED with TRUSTED on a STARTED profile use the RACF RALTER and SETROPTS commands: RALTER STARTED <profile> + STDATA(TRUSTED) SETROPTS REFRESH RACLIST(STARTED)

Svojstva

Operativni sistemi: Bilo koji
Oznake: ibm-zhardening
Referenca: CIS IBM z/OS with RACF Benchmark v1.0.0 - 2.4.5 Ensure that started tasks defined with the PRIVILEGED attribute is justified