WebSphere MQ resource classes must be properly activated for security checking by the ESM.

An XCCDF Rule

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

ID: SV-224557r1055910_rule
Version: ZWMQ0049
Severity: Medium
References: CCI-000213 CCI-002358
Updated: 6 days ago

Remediation Templates

Ensure that all WebSphere MQ resources are active and properly defined.

Ensure the following WebSphere MQ resource classes are active:

GMQADMIN
GMQNLISTGMQPROC
GMQQUEUE
MQADMIN
MQCMDS
MQCONN
MQNLIST
MQPROC
MQQUEUE

When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries:

GMXADMIN
GMXNLIST
GMXPROC
GMXQUEUE
GMXTOPIC
MXADMIN
MXNLIST
MXPROC
MXQUEUE
MXTOPIC

NOTE: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

The follow sample contains commands to activate the required classes:

SETR CLASSACT(MQADMIN MQCMDS MQCONN)
SETR CLASSACT(MQNLIST MQPROC MQQUEUE)
SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)

WebSphere MQ resource classes must be properly activated for security checking by the ESM.

Description

Remediation Templates

A Manual Procedure