WebSphere MQ started tasks are not defined in accordance with the proper security requirements.

An XCCDF Rule

Description

Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data.

ID: SV-225627r958482_rule
Version: ZWMQ0030
Severity: Medium
References: CCI-000764
Updated: 6 days ago

Remediation Templates

Review WebSphere MQ started tasks and ensure the following items are in effect:

NOTE: 
           ssid is the queue manager name (a.k.a., subsystem 
             identifier).
           ssidMSTR is the name of a queue manager STC.           ssidCHIN is the name of a distributed queuing (a.k.a.,  
             channel initiator) STC.

1) Each WebSphere MQ started task is associated with a unique ACID.

2) Each WebSphere MQ started task is defined to the STC record with a unique ACID.

3) Each ssidMSTR STC ACID has a corresponding WebSphere MQ MASTFAC as defined in the z/OS.

i.e. A Started Task Table entry exists for each queue manager started task procedure xxxxMSTR and distributed queuing started task procedure xxxxCHIN.  A corresponding userid for each started task exists.  Queue manager and channel initiator started tasks will not be defined with the BYPASS attribute.

4) WebSphere MQ queue manager facilities are defined using the control options as specified below:

Define each queue manager xxxxMSTR to the TOP SECRET Facility Matrix Table using the following sample commands:

FACILITY(USERxx=NAME=xxxxMSTR)
FACILITY(xxxxMSTR=MODE=FAIL,PGM=CSQ,ID=xx)
FACILITY(xxxxMSTR=ACTIVE,SHRPRF,ASUBM,NOABEND)
FACILITY(xxxxMSTR=MULTUSER,XDEF,LUMSG,STMSG,SIGN(S))
FACILITY(xxxxMSTR=INSTDATA,NORNDPW,AUTHINIT)
FACILITY(xxxxMSTR=NOPROMPT,NOAUDIT,RES,WARNPW)
FACILITY(xxxxMSTR=NOTSOC,LCFTRANS,IJU,MSGLC,NOTRACE)
FACILITY(xxxxMSTR=NOEODINIT,NODORMPW,NONPWR)
(INIT,SMF,MSG,SEC9))
FACILITY(xxxxMSTR=DOWN=GLOBAL,LOCKTIME=00,DEFACID=(*NONE*))

WebSphere MQ started tasks are not defined in accordance with the proper security requirements.

Description

Remediation Templates

A Manual Procedure