IBM RACF batch jobs must be properly secured.
An XCCDF Rule
Description
Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited. Satisfies: SRG-OS-000080-GPOS-00048, SRG-OS-000326-GPOS-00126
- ID
- SV-223672r958472_rule
- Version
- RACF-ES-000240
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure each batch job userid used for batch submission by a Job Scheduler (e.g., CONTROL-M, CA-7, CA-Scheduler, etc.) is defined as an execution-userid in a SURROGAT resource class profile. For example:
RDEFINE SURROGAT execution-userid.SUBMIT UACC(NONE)
OWNER(execution-userid)
Configure Job Scheduler userids (i.e., surrogate-userid) are permitted surrogate authority to the appropriate SURROGAT profiles. For example: