{"stig":{"title":"zOS WebsphereMQ for ACF2 Security Technical Implementation Guide","version":"7","release":"1"},"checks":[{"vulnId":"V-224354","ruleId":"SV-224354r958408_rule","severity":"high","ruleTitle":"WebSphere MQ channel security must be implemented in accordance with security requirements.","description":"WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.\n\nSatisfies: SRG-OS-000505, SRG-OS-000555","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nCollect the following information for WebSphere MQ and MQSeries queue manager.\n\n- If a WebSphere MQ queue manager communicates with a MQSeries queue manager, provide the WebSphere MQ queue manager and channel names used to connect with MQSeries.\n\nAutomated Analysis requires Additional Analysis.\nAutomated Analysis\nRefer to the following report produced by the z/OS Data Collection:\n\n- PDI(ZWMQ0011)\n\nIf the following guidelines are true for each channel definition displayed from the DISPLAY CHANNEL command, this is not a finding.\n\n___ Verify that each WebSphere MQ channel is using SSL by checking for the SSLCIPH parameter, which must specify a FIPS 140-2 compliant value of the following: (Note: Both ends of the channel must specify the same cipher specification.)\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256\n\n___ Repeat the above step for each queue manager ssid identified.","fixText":"Review the WebSphere MQ Screen interface invoked by the REXX CSQOREXX. Review the channel's SSLCIPH setting.\n\nDisplay the channel properties and look for the \"SSL Cipher Specification\" value.\n\nEnsure that a FIPS 140-2 compliant value is shown.\n\nECDHE_ECDSA_AES_128_CBC_SHA256\nECDHE_ECDSA_AES_256_CBC_SHA384\nECDHE_RSA_AES_128_CBC_SHA256\nECDHE_RSA_AES_256_CBC_SHA384\nTLS_RSA_WITH_3DES_EDE_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_256_CBC_SHA256\n\nNote that both ends of the channel must specify the same cipher specification. \n\nRepeat these steps for each queue manager ssid identified.","ccis":["V-6958"]},{"vulnId":"V-224355","ruleId":"SV-224355r958868_rule","severity":"medium","ruleTitle":"WebSphere MQ channel security is not implemented in accordance with security requirements.","description":"WebSphere MQ channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. WebSphere MQ channels use SSL encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier). To determine which Release of WebSphere MQ, review ssid reports for message CSQU000I.\n\nCollect the following information for WebSphere MQ queue manager:\n\n- If a WebSphere MQ queue manager communicates with a MQSeries queue manager, provide the WebSphere MQ queue manager and channel names used to connect with MQSeries.\n- If any WebSphere MQ channels are used to communicate within the enclave, provide a list of channels and provide documentation regarding the sensitivity of the information on the channel.\n\nb) Review the ssid report(s) and perform the following steps:\n\n1) Find the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions.\n2) Verify that each WebSphere MQ 5.3 queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified.  i.e. SSLKEYR(sslkeyring-id)\n3) Issue the following ACF2 command, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtained from the above action:\n\nLIST ssidCHIN PROFILE(CERTDATA, KEYRING)\n\nThe output will contain information on the CERTDATA and KEYRING records for the user. Find the CERTDATA entry that has a Key ring name field with sslkeyring-id. Review the ISSUERDN field for this CERTDATA record for the following:\n\nOU=PKI.OU=DoD.O=U.S. Government.C=US\nOU=ECA.O=U.S. Government.C=US\n\n4) Repeat these steps for each queue manager ssid identified.\n\nc) If the all of the items in (b) above are true, there is no finding.\n\nd) If any of the items in (b) above are untrue, this is a finding.","fixText":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier). \n\n1) Find the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions.\n2) Verify that each WebSphere MQ queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified.  i.e. SSLKEYR(sslkeyring-id)\n3) Issue the following ACF2 command, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator's userid and sslkeyring-id is obtain from the above action:\n\nLIST ssidCHIN PROFILE(CERTDATA, KEYRING)\n\nThe output will contain information on the CERTDATA and KEYRING records for the user. Find the CERTDATA entry that has a Key ring name field with sslkeyring-id. Review the ISSUERDN field for this CERTDATA record for the following:\n\nOU=PKI.OU=DoD.O=U.S. Government.C=US\nOU=ECA.O=U.S. Government.C=US\n\nNOTE: The Certificate Label Name is case sensitive.\n\nReview the Issuer's Name field in the resulting output for information of any of the following:\n\nOU=PKI.OU=DoD.O=U.S. Government.C=US\nOU=ECA.O=U.S. Government.C=US\n\n4) Repeat these steps for each queue manager ssid identified.\n\nTo implement the requirements stated above, the following two items are provided which attempt to assist with (1) Technical \"how to\" information and (2) A DISA Point of contact for obtaining SSL certificates for CSD WebSphere MQ channels:\n\n1. Review the information available on setting up SSL, Keyrings, and Digital Certificates in the CA-ACF2 Security for z/OS Administrators Guide as well as the WebSphere MQ Security manual. Also review the information contained in the documentation provided as part of the install package from the DISA SSO Resource Management Factory (formerly Software Factory).\n\n2. For information on obtaining an SSL certificate in the DISA CSD environment, send email inquiry to disaraoperations@disa.mil.","ccis":["V-6980"]},{"vulnId":"V-224356","ruleId":"SV-224356r959010_rule","severity":"medium","ruleTitle":"Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF).","description":"IBM WebSphere MQ can use a user ID associated with an ACP certificate as a channel user ID. When an entity at one end of an SSL channel receives a certificate from a remote connection, the entity asks The ACP if there is a user ID associated with that certificate. The entity uses that user ID as the channel user ID. If there is no user ID associated with the certificate, the entity uses the user ID under which the channel initiator is running. Without a validly defined Certificate Name Filter for the entity IBM WebSphere MQ will set the channel user ID to the default.","checkContent":"Validate that the list of all Production WebSphere MQ Remotes exist, and contains approved Certified Name Filters and associated USERIDS.\n\nIf the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding. \n\nIf there is no Certificate Name Filter for WebSphere MQ Remotes this is a Finding.\n\nNote: Improper use of CNF filters for MQ Series will result in the following Message ID.\n\nCSQX632I found in the following example:\n\nCSQX632I csect-name SSL certificate has no\nassociated user ID, remote channel\nchannel-name - channel initiator user ID\nused\n\n","fixText":"The responsible MQ System programmer(s) shall create and maintain a spread sheet that contains a list of all Production WebSphere MQ Remotes, associated individual USERIDs with corresponding valid Certified Name Filters (CNF). This documentation will be reviewed and validated annually by responsible MQ System programmer(s) and forwarded for approval by the ISSM.\n\nThe ISSO will define the associated USERIDs, the CNF, and grant the minimal need to know access, by granting only the required resources and Commands for each USERID in the ACP. See IBM WebSphere MQ Security manual for details on defining CNF for WebSphere MQ.\n\nGeneric access shall not be granted such as resource permission at the SSID. MQ resource level.\n","ccis":["V-31561"]},{"vulnId":"V-224357","ruleId":"SV-224357r1070071_rule","severity":"medium","ruleTitle":"User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements.\n","description":"Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n-\tMQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nAutomated Analysis\nRefer to the following report produced by the z/OS Data Collection:\n\n-\tPDI(ZWMQ0020)\n\nReview the ssid report(s) and perform the following steps:\n\n1. Find the DISPLAY SECURITY command to locate the start of the security parameter settings.\n2. Review the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively.\n3. Repeat these steps for each queue manager ssid.\n\nThe standard values are:\n\nTIMEOUT(15)\nINTERVAL(5)\n\nIf the Timeout and Interval values conform to the standard values, this is not a finding.\n\nIf the Timeout and/or Interval values do not conform to the standard values, this is a finding.","fixText":"Review the WebSphere MQ System Setup Guide and the information on the ALTER SECURITY command in the WebSphere MQ Script (MQSC) Command Reference.\n\nEnsure the values for the TIMEOUT and INTERVAL parameters are specified in accordance with security requirements.","ccis":["V-3903"]},{"vulnId":"V-224358","ruleId":"SV-224358r958482_rule","severity":"medium","ruleTitle":"WebSphere MQ started tasks are not defined in accordance with the proper security requirements.","description":"Started tasks are used to execute WebSphere MQ queue manager services.  Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability.  This exposure could compromise the availability of some system services and application data.","checkContent":"a)\tRefer to the following reports produced by the ACF2 Data Collection:\n\n-\tACF2CMDS.RPT(LOGONIDS)\n-\tACF2CMDS.RPT(ATTSTC)\n\nProvide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels.\n\nb)\tReview WebSphere MQ started tasks and ensure the following items are in effect:\n\nNOTE:\tssid is the queue manager name (a.k.a., subsystem identifier).\nssidMSTR is the name of a queue manager STC.\nssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.\n\n1)\tEach ssidMSTR and ssidCHIN started task is associated with a unique logonid.\n2)\tEach ssidMSTR and ssidCHIN STC logonid has the attributes of STC, MUSASS, and NOSMC.\n\nc)\tIf both of the items in (b) are true, there is NO FINDING.\n\nd)\tIf either item in (b) is untrue, this is a FINDING.","fixText":"The IAO will ensure that all MQSeries/WebSphere MQ started tasks are properly defined.\n\nReview MQSeries/WebSphere MQ started tasks and ensure the following items are in effect:\n\nNOTE:\tssid is the queue manager name (a.k.a., subsystem identifier).\nssidMSTR is the name of a queue manager STC.\nssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC.\n\n1)\tEach MQSeries/WebSphere MQ started task is associated with a unique logonid.\n\n2)\tEach MQSeries/WebSphere MQ STC logonid has the attributes of STC, MUSASS, and NOSMC.\n\nExample:\n\nSET LID \nINSERT ssid.MSTR NAME(MQseries, STC) STC MUSASS NO-SMC\n\nINSERT ssid.CHIN NAME(MQseries, STC) STC MUSASS NO-SMC\n\n\n\n\n","ccis":["SV-3904"]},{"vulnId":"V-224359","ruleId":"SV-224359r1070014_rule","severity":"medium","ruleTitle":"WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted.","description":"MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the ACP Data Collection:\n\n-\tSENSITVE.RPT(MQSRPT)\n\nEnsure ACP data sets rules for MQSeries/WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows:\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nREAD access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and system programming personnel. All access to these data sets is logged.\n\nDDname\tProcedure\tDescription\nCSQINP1\tssidMSTR\tInput parameters\nCSQINP2\tssidMSTR\tInput parameters\nCSQXLIB\tssidCHIN\tUser exit library\n\nNote: WRITE/UPDATE and/or ALLOCATE/ALTER access to these data sets is restricted to MQSeries/WebSphere MQ administrators and systems programming personnel.\n\nWRITE/UPDATE and/or ALLOCATE/ALTER access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and systems programming personnel. All WRITE and ALLOCATE access to these data sets is logged.\n\nDDname             Procedure          Description\nCSQPxxxx           ssidMSTR            Page data sets\nBSDSx\t              ssidMSTR            Bootstrap data sets\nCSQOUTx           ssidMSTR            SYSOUT data sets\nCSQSNAP           ssidMSTR            DUMP data set\n(See note)          ssidMSTR            Log data sets\n\nNote: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain DSNs.\n \nALLOCATE/ALTER access to archive data sets is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrator, and system programming personnel. All ALLOCATE/ALTER access to these data sets is logged.\n\nNote: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 DSN HLQs.\n\nExcept for the specific data set requirements just mentioned, WRITE/UPDATE and/or ALLOCATE/ALTER access to all other MQSeries/WebSphere MQ system data sets is restricted to the MQSeries/WebSphere MQ administrator and system programming personnel.\n\nIf all the above are true, this is not a finding.\n\nIf any of the above are untrue, this is a finding.","fixText":"The systems programmer will have the ISSO ensure that all update and alter access to MQSeries/WebSphere MQ product and system data sets are restricted to WebSphere MQ administrators, systems programmers, and MQSeries/WebSphere MQ started tasks.\n\nThe installation requires that the following data sets be APF authorized.  \n\nhlqual.SCSQAUTH\nhlqual.SCSQLINK\nhlqual.SCSQANLx\nhlqual.SCSQSNL\nhlqual.SCSQMVR1\nhlqual.SCSQMVR2\n\nRead access to data sets referenced by the CSQINP1, CSQINP2, and CSQXLIB DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all access to these data sets.\n\nWrite and allocate access to data set profiles protecting all page sets, logs, bootstrap data sets (BSDS), and data sets referenced by the CSQOUTX and CSQSNAP DDs in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all write and allocate access to these data sets.\n\nAllocate access to all archive data sets in the queue manager's procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all allocate access to these data sets.","ccis":["SV-3905"]},{"vulnId":"V-224360","ruleId":"SV-224360r1055908_rule","severity":"medium","ruleTitle":"WebSphere MQ resource classes must be properly activated.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the ACF2 Data Collection:<br /><br />- ACF2CMDS.RPT(ACFGSO)<br /><br />Ensure the System Authorization Facility Definition (SAFDEF) includes an entry for WebSphere MQ as follows:<br /><br />INSERT SAFDEF.MQS ID(MQS) FUNCRET(8) RETCODE(4) MODE(IGNORE)<br />RACROUTE(REQUEST=EXTRACT,CLASS=MQADMIN) REP<br /><br />If the Internal CLASMAP Definitions do not include the following entries, this is a finding.<br /><br />INSERT CLASMAP.MQADMIN RESOURCE(MQADMIN) RSRCTYPE(MQA) ENTITYLN(62)<br />INSERT CLASMAP.MQCMDS RESOURCE(MQCMDS) RSRCTYPE(MQC) ENTITYLN(22)<br />INSERT CLASMAP.MQCONN RESOURCE(MQCONN) RSRCTYPE(MQK) ENTITYLN(10)<br />INSERT CLASMAP.MQNLIST RESOURCE(MQNLIST) RSRCTYPE(MQN) ENTITYLN(53)<br />INSERT CLASMAP.MQPROC RESOURCE(MQPROC) RSRCTYPE(MQP) ENTITYLN(53)<br />INSERT CLASMAP.MQQUEUE RESOURCE(MQQUEUE) RSRCTYPE(MQQ) ENTITYLN(53)<br /><br />When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries:<br /><br />INSERT CLASMAP.MXADMIN RESOURCE(MXADMIN) RSRCTYPE(MXA) ENTITYLN(62)<br />INSERT CLASMAP.MXNLIST RESOURCE(MXNLIST) RSRCTYPE(MXN) ENTITYLN(53)<br />INSERT CLASMAP.MXPROC RESOURCE(MXPROC) RSRCTYPE(MXP) ENTITYLN(53)<br />INSERT CLASMAP.MXQUEUE RESOURCE(MXQUEUE) RSRCTYPE(MXQ) ENTITYLN(53)<br />INSERT CLASMAP.MXTOPIC RESOURCE(MXTOPIC) RSRCTYPE(MXT) ENTITYLN(246)<br /><br />If when SCYCASE is set to mixed, CLASMAP Definitions do not include entries as shown above, this is a finding.","fixText":"The ISSO will ensure that all WebSphere MQ resources are active and properly defined.\n\nEnsure the System Authorization Facility Definition (SAFDEF) includes an entry for WebSphere MQ as follows:\n\nINSERT SAFDEF.MQS ID(MQS) FUNCRET(8) RETCODE(4) MODE(IGNORE)\nRACROUTE(REQUEST=EXTRACT,CLASS=MQADMIN) REP\n\nEnsure the Internal CLASMAP Definitions include the following entries:\n\nINSERT CLASMAP.MQADMIN RESOURCE(MQADMIN) RSRCTYPE(MQA) ENTITYLN(62)\nINSERT CLASMAP.MQQUEUE RESOURCE(MQQUEUE) RSRCTYPE(MQQ) ENTITYLN(53)\nINSERT CLASMAP.MQNLIST RESOURCE(MQNLIST) RSRCTYPE(MQN) ENTITYLN(53)\nINSERT CLASMAP.MQCMDS RESOURCE(MQCMDS) RSRCTYPE(MQC) ENTITYLN(22)\nINSERT CLASMAP.MQCONN RESOURCE(MQCONN) RSRCTYPE(MQK) ENTITYLN(10)\nINSERT CLASMAP.MQPROC RESOURCE(MQPROC) RSRCTYPE(MQP) ENTITYLN(53)\n\nWhen SCYCASE is set to mixed CLASMAP Definitions must include the following entries:\n\nINSERT CLASMAP.MXADMIN RESOURCE(MXADMIN) RSRCTYPE(MXA) ENTITYLN(62)\nINSERT CLASMAP.MXNLIST RESOURCE(MXNLIST) RSRCTYPE(MXN) ENTITYLN(53)\nINSERT CLASMAP.MXPROC RESOURCE(MXPROC) RSRCTYPE(MXP) ENTITYLN(53)\nINSERT CLASMAP.MXQUEUE RESOURCE(MXQUEUE) RSRCTYPE(MXQ) ENTITYLN(53)\nINSERT CLASMAP.MXTOPIC RESOURCE(MXTOPIC) RSRCTYPE(MXT) ENTITYLN(246)","ccis":["V-6959"]},{"vulnId":"V-224361","ruleId":"SV-224361r1056161_rule","severity":"high","ruleTitle":"Websphere MQ switch profiles must be properly defined to the appropriate class.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the OS/390 & z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nAutomated Analysis requires Additional Analysis.\nAutomated Analysis\nRefer to the following report produced by the OS/390 & z/OS Data Collection:\n\n- PDI(ZWMQ0051)\n\nb) Review the Security switches identified in response to the DISPLAY SECURITY command in each ssid report(s). If all of the following switches specify ON, there is no finding.\n\nSUBSYSTEM\nCONNECTION\nCOMMAND\nCONTEXT\nALTERNATE USER\nPROCESS\nNAMELIST\nQUEUE\nCOMMAND RESOURCES\n\nc) If SUBSYSTEM specifies OFF, this is a finding with a severity of Category I.\n\nd) If any of the other above switches specify OFF (other than the exception mentioned below), this is a finding and downgrades the severity to a Category II. \n\ne) If COMMAND RESOURCE Security switch specifies OFF, there is no finding.\n\nNOTE: At the discretion of the ISSO, COMMAND RESOURCE Security switch may specify OFF by defining ssid.NO.CMD.RESC.CHECKS in the TYPE(MQA).","fixText":"Ensure that all Switch Profiles do not have the resource ssid.NO defined to the MQADMIN (or MXADMIN if SCYCASE is set to MIXED) resource class with the exception of ssid.NO.CMD.RESC.CHECKS.\n\nssid is the queue manager name (a.k.a., subsystem identifier).\n\nEnsure that all of the following switches specify ON.\n\nSUBSYSTEM\nCONNECTION\nCOMMAND\nCONTEXT\nALTERNATE USER\nPROCESS\nNAMELIST\nQUEUE\nCOMMAND RESOURCES\n\nExample:\n\n$KEY(ssid) TYPE(MQA)\nALTERNATE.USER.- UID(*) PREVENT\nCONTEXT.- UID(*) PREVENT\nRESLEVEL UID(*) PREVENT\n- UID(*) PREVENT\n\nNOTE: At the discretion of the ISSO, COMMAND RESOURCE Security switch may specify OFF by defining ssid.NO.CMD.RESC.CHECKS in the TYPE(MQA).\n\nExample:\n\n$KEY(ssid) TYPE(MQA)\nNO.CMD.RESC.CHECKS UID(*) PREVENT","ccis":["SV-7261"]},{"vulnId":"V-224362","ruleId":"SV-224362r1070008_rule","severity":"medium","ruleTitle":"WebSphere MQ connection class resources must be protected in accordance with security.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the ACF2 Data Collection:\n\n-\tSENSITVE.RPT(MQCONN)\n-\tACF2CMDS.RPT(RESOURCE) - Alternate report\n\nReview the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED):\n\nResource         Authorized Users\nssid.BATCH     TSO and batch job userids\nssid.CICS         CICS region userids\nssid.IMS          IMS region userids\nssid.CHIN        Channel initiator userids\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nFor all connection resources defined to TYPE(MQK), ensure the following items are in effect:\n\n1. Access authorization to these connections restricts access to the appropriate users as indicated in (b).\n2. All access FAILUREs are logged.\n\nIf both of the above are true, this is not a finding.\n\nIf either of the above is untrue, this is a finding.","fixText":"Ensure all connections to MQSeries/WebSphere MQ resources are restricted using connection security.\n\nEnsure the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED):\n\nResource       Authorized Users\nssid.BATCH       TSO and batch job userids\nssid.CICS       CICS region userids\nssid.IMS       IMS region userids\nssid.CHIN       Channel initiator userids\n\nNote: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nFor all connection resources defined to TYPE(MQK), ensure the following items are in effect:\n\nAccess authorization to these connections restricts access to the appropriate users as indicated above.\n\nAll access FAILURE is logged.\n\nExample:\n\n$KEY(ssid) TYPE(MQK)\nBATCH UID(STCssid) SERVICE(READ)  \nBATCH UID(syspaudt) SERVICE(READ)  \nBATCH UID(*) PREVENT \nCHIN UID(STCssidCHIN) SERVICE(READ)  \nCHIN UID(*) PREVENT \nCICS UID(*) PREVENT \nIMS UID(*) PREVENT","ccis":["V-6962"]},{"vulnId":"V-224363","ruleId":"SV-224363r958482_rule","severity":"medium","ruleTitle":"WebSphere MQ dead letter and alias dead letter queues are not properly defined.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the  z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nb) Review the ssid report(s) and perform the following steps:\n\n1) Find the DISPLAY QMGR DEADQ command to locate the start of the dead-letter queue information. Review the DEADQ parameter to obtain the name of the real dead-letter queue.\n\n2) From the top of the report, find the QUEUE(dead-letter.queue.name) entry to locate the start of the real dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to the specified security requirements.\n\nThe  standard values are:\n\nGET(ENABLED)\nPUT(ENABLED)\n\nNOTE: Dead-letter.queue.name is the value of the DEADQ parameter determined in Step 1.\n \n3) From the top of the report, find the QUEUE(dead-letter.queue.name.PUT) entry to locate the start of the alias dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to those specified in the security requirements.\n\nThe standard values are:\n\nGET(DISABLED)\nPUT(ENABLED)\n\nNOTE 1: Dead-letter.queue.name is the value of the DEADQ parameter determined in Step 1.\n\nNOTE 2: The TARGQ parameter value for the alias queue will be the real dead letter queue name.\n\nNOTE 3:  If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue must be coded to restrict unauthorized users and systems from reading the messages on the file.\n\nc) If all of the items in (b) are true, there is no finding.\n\nd) If any item in (b) is untrue, this is a finding.","fixText":"The systems programmer responsible for supporting MQSeries/WebSphere MQ will ensure that the dead-letter queue and its alias are properly defined.\n\nThe following scenario describes how to securely define a dead-letter queue:\n\n(1) Define the real dead-letter queue with attributes PUT(ENABLED) and GET(ENABLED).\n\n(2) Give update authority for the dead-letter queue to CKTI (the MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators, and any automated application used for dead-letter queue maintenance.\n\n(3) Define an alias queue that resolves to the real dead-letter queue, but give the alias queue the attributes PUT(ENABLED) and GET(DISABLED).\n\n(4) To put a message on the dead-letter queue, an application uses the alias queue. The application does the following:\n\n(a) Retrieve the name of the real dead-letter queue. To do this, it opens the queue manager object using MQOPEN, and then issues an MQINQ to get the dead-letter queue name.\n\n(b) Build the name of the alias queue by appending the characters \".PUT\" to this name, in this case, ssid.DEAD.QUEUE.PUT.\n\n(c) Open the alias queue, ssid.DEAD.QUEUE.PUT.\n\n(d) Put the message on the real dead-letter queue by issuing an MQPUT against the alias queue.\n\n(5) Give the userid associated with the application update authority to the alias, but no access to the real dead-letter queue.\n\nNOTE: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue will be coded to restrict unauthorized users and systems from reading the messages on the file.\n\nUndeliverable messages can be routed to a dead-letter queue. Two levels of access should be established for these queues. The first level allows applications, as well as some MQSeries/WebSphere MQ objects, to put messages to this queue. The second level restricts the ability to get messages from this queue and protects sensitive data. This will be accomplished by defining an alias queue that resolves to the real dead-letter queue, but defines the alias queue with the attributes PUT(ENABLED) and GET(DISABLED). The ability to get messages from the dead-letter queue will be restricted to message channel agents (MCAs), CKTI (MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators utility, and any automated application used for dead-letter queue maintenance.","ccis":["SV-7267"]},{"vulnId":"V-224364","ruleId":"SV-224364r1050677_rule","severity":"medium","ruleTitle":"WebSphere MQ queue resource defined to the MQQUEUE or MXQUEUE resource class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"Refer to the following report produced by the z/OS Data Collection:\n\n- MQSRPT(ssid)\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier). \n\nRefer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQQUEUE)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nFor all queue identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. Ensure these queue resources are defined to TYPE(MQQ) (i.e., MQQUEUE or MQQUEUE resource class). If the following guidance is true, this is not a finding.\n\n1) For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Decentralized MQ Administrators, non-DECC datacenter users, can have up to ALTER access to the user Message Queues.\n\n2) For system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts UPDATE and/or ALTER access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications.\n\n3) For the following system queues, ensure that UPDATE access is restricted to Auditors and Users that require access to review message queues.\nssid.SYSTEM.COMMAND.INPUT\nssid.SYSTEM.COMMAND.REPLY\nssid.SYSTEM.CSQOREXX.*\nssid.SYSTEM.CSQUTIL.*\n\n4) For the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance.\n\n5) For the alias dead-letter queue (to determine queue name refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.","fixText":"The ISSO will ensure that all WebSphere MQ queues are restricted using queue level security.\n\nEnsure all queue resources defined to TYPE(MQQ) (i.e., MQQUEUE OR m resource class), are in effect:\n\nFor all queues identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid), these queues will be prefixed by ssid to identify the resources to be protected. Ensure these queue resources are defined to TYPE(MQQ) (i.e., MQQUEUE OR MXQUEUE resource class. If the following guidance is true, this is not a finding.\n\n1) For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Decentralized MQ Administrators, non-DECC datacenter users, can have up to ALTER access to the user Message Queues.\n\n2) For system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts UPDATE and/or ALTER access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications.\n\n3) For the following system queues, ensure that UPDATE access is restricted to Auditors and Users that require access to review message queues.\nssid.SYSTEM.COMMAND.INPUT\nssid.SYSTEM.COMMAND.REPLY\nssid.SYSTEM.CSQOREXX.*\nssid.SYSTEM.CSQUTIL.*\n\n4) For the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance.\n\n5) For the alias dead-letter queue (to determine queue name refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\nExample:\n\n$KEY(ssid) TYPE(MQQ)\nDEAD.QUEUE UID(STCssidCHIN) SERVICE(READ,UPDATE) LOG\nDEAD.QUEUE UID(MQAdministrators) SERVICE(READ,UPDATE) LOG\nDEAD.QUEUE UID(*) PREVENT\n- UID(*) PREVENT","ccis":["SV-7268"]},{"vulnId":"V-224365","ruleId":"SV-224365r1050680_rule","severity":"medium","ruleTitle":"WebSphere MQ Process resources must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection:\n\n- SENSITVE.RPT(MQPROC)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nb) For all process resources (i.e., ssid.processname) defined to TYPE(MQP) (i.e., MQPROC resource class or MXPROC resource class if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to make process inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nc) If (b) is true, there is no finding.\n\nd) If (b) is untrue, this is a finding.","fixText":"The ISSO will ensure that process security is active, all profiles are defined to the MQPROC class, and process inquiries are restricted to read access.\n\nFor all process resources (i.e., ssid.processname) defined to TYPE(MQP) (i.e., MQPROC resource class or MXPROC resource class if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to make process inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nExample:\n\n$KEY(ssid) TYPE(MQP)\nCHL_TRIG_PROCESS UID(MQAdministrators) SERVICE(READ) LOG \nCHL_TRIG_PROCESS UID(*) PREVENT\nSYSTEM.DEFAULT.PROCESS UID(MQAdministrators) SERVICE(READ) LOG\nSYSTEM.DEFAULT.PROCESS UID(*)  PREVENT","ccis":["V-6966"]},{"vulnId":"V-224366","ruleId":"SV-224366r1050683_rule","severity":"medium","ruleTitle":"WebSphere MQ Namelist resources must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection:\n\n- SENSITVE.RPT(MQNLIST)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nb) For all namelist resources (i.e., ssid.namelist) defined to TYPE(MQN)(i.e., MQNLIST resource class or MXNLIST resource class if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to make namelist inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nc) If (b) is true, there is no finding.\n\nd) If (b) is untrue, this is a finding.","fixText":"The ISSO will ensure that all MQSeries/WebSphere MQ namelist resources are restricted to authorized users.\n\nFor all namelist resources (i.e., ssid.namelist) defined to TYPE(MQN) (i.e., MQNLIST resource class or MXNLIST resource class if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to make namelist inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nExample:\n\n$KEY(QZN1) TYPE(MQN)\nSYSTEM.DEFAULT.NAMELIST UID(MQAdministrators) SERVICE(READ) LOG\nSYSTEM.DEFAULT.NAMELIST UID(*) PREVENT","ccis":["SV-7270"]},{"vulnId":"V-224367","ruleId":"SV-224367r1050686_rule","severity":"medium","ruleTitle":"WebSphere MQ alternate user resources defined to the appropriate resource class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection:\n\n- SENSITVE.RPT(MQADMIN)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nb) For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternatelogonid) defined to TYPE(MQA) (i.e., MQADMIN resource class or MXADMIN if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nc) If (b) is true, there is no finding.\n\nd) If (b) is untrue, this is a finding.","fixText":"The ISSO will ensure that use of alternate userids is restricted to authorized personnel.\n\nFor all alternate user resources (i.e., ssid.ALTERNATE.USER.alternatelogonid) defined to TYPE(MQA) (MQADMIN resource class or MXADMIN if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nExample:\n\n$KEY(ssid) TYPE(MQA)\nALTERNATE.USER.- UID(CICS support) SERVICE(READ,UPDATE) LOG \nALTERNATE.USER.- UID(*) PREVENT","ccis":["SV-7272"]},{"vulnId":"V-224368","ruleId":"SV-224368r1050689_rule","severity":"medium","ruleTitle":"WebSphere MQ context resources defined to the appropriate resource class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection:\n\n- SENSITVE.RPT(MQADMIN)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nb) For all context resources (i.e., ssid.CONTEXT) defined to TYPE(MQA) (i.e., MQADMIN resource class or MXADMIN if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nc) If (b) is true, there is no finding.\n\nd) If (b) is untrue, this is a finding.","fixText":"The ISSO will ensure that use of context resources are restricted to authorized personnel.\n\nFor all context resources (i.e., ssid.CONTEXT) defined to TYPE(MQA) (i.e., MQADMIN resource class or MXADMIN if SCYCASE is set to MIXED), ensure access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\nExample:\n\n$KEY(ssid) TYPE(MQA)\nCONTEXT.- UID (CICS SUPPORT) LOG\nCONTEXT.- UID(*) PREVENT","ccis":["SV-7274"]},{"vulnId":"V-224369","ruleId":"SV-224369r958472_rule","severity":"medium","ruleTitle":"WebSphere MQ command resources defined to MQCMDS resource class are not protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQCMDS)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nb) For all command resources (i.e., ssid.command) defined to TYPE(MQC) (i.e., MQCMDS resource class, ensure the following items are in effect:\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\n1) Access authorization restricts access to the appropriate personnel as designated in the WebSphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.\n2) All command access is logged as designated in the WebSphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum.\n\nc) If both of the items in (b) are true, there is no finding.\n\nd) If either item in (b) is untrue, this is a finding.","fixText":"The ISSO will ensure that all MQSeries/WebSphere MQ commands are restricted to authorized personnel.\n\nFor all command resources (i.e., ssid.command) defined to TYPE(MQC) (i.e., MQCMDS resource class, ensure the following items are in effect:\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\n1) Access authorization restricts access to the appropriate personnel as designated in the table entitled WebSphere MQ COMMAND SECURITY CONTROLS,in the zOS STIG Addendum.\n\n2) All command access is logged as designated in the table entitled WebSphere MQ COMMAND SECURITY CONTROLS, in the zOS STIG Addendum.\n\nExample:\n\n$KEY(ssid) TYPE(MQC)\nALTER.- UID(syspaudt) SERVICE(READ,ADD,UPDATE) LOG\nALTER.- UID(*) PREVENT\n\nSET R(MQC)\nCOMPILE 'ACF2.MVA.MQC(ssid)' STORE\n\nF ACF2,REBUILD(MQC)\n","ccis":["SV-7276"]},{"vulnId":"V-224370","ruleId":"SV-224370r1055909_rule","severity":"medium","ruleTitle":"WebSphere MQ RESLEVEL resources in the appropriate ADMIN resource class must be protected in accordance with security requirements.","description":"WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.","checkContent":"a) Refer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection:\n\n- SENSITVE.RPT(MQADMIN)\n- ACF2CMDS.RPT(RESOURCE) - Alternate report\n\nAutomated Analysis\nRefer to the following report produced by the Data Set and Resource Data Collection:\n\n- PDI(ZWMQ0060)\n\nb) Ensure the following items are in effect:\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\n1) A RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to TYPE(MQA) (i.e., MQADMIN or MXADMIN resource class) with a default access of PREVENT.\n2) Access authorization to these RESLEVEL resources restricts all access. No users are permitted access to ssid.RESLEVEL resources.\n\nc) If both of the items in (b) are true, there is no finding.\n\nd) If either item in (b) is untrue, this is a finding.","fixText":"Ensure that a ssid.RESLEVEL profile is only defined for each queue manager.\n\nEnsure the following items are in effect:\n\nNOTE: ssid is the queue manager name (a.k.a., subsystem identifier).\n\n1) A RESLEVEL resource (i.e., ssid.RESLEVEL) is defined for each queue manager to TYPE(MQA) (i.e., MQADMIN or MZADMIN resource class) with a default access of PREVENT.\n2) Access authorization to these RESLEVEL resources restricts all access. No users are permitted access to ssid.RESLEVEL resources.\n\nExample:\n\n$KEY(ssid) TYPE(MQA)\nRESLEVEL UID(*) PREVENT","ccis":["V-6975"]}]}