OA68298: CIS-OS-6.5.6 INCORRECTLY REPORTS NON-COMPLIANCE FOR AN ID WHICH ONLY HAS STACK ACCESS AND IS NOT AN FTP USER

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• CIS-OS-6.5.6 incorrectly reports non-compliance for an ID which
  only has Stack access and is not an FTP user.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users of zSecure Audit exploiting the RACF   *
  *                 z/OS CIS 6.5.6 compliance control.           *
  ****************************************************************
  * PROBLEM DESCRIPTION: zSecure Audit's RACF z/OS CIS 6.5.6     *
  *                      compliance control might report         *
  *                      incorrect non-compliant results.        *
  ****************************************************************
  * RECOMMENDATION: Apply the PTF provided.                      *
  ****************************************************************
  The RACF z/OS CIS 6.5.6 compliance control (Ensure access to
  TCP/IP SAF resources) provided by zSecure Audit might report
  incorrect non-compliant findings for IDs that are permitted
  access to the TCP/IP stack but are not FTP only users. However,
  these users do require this permitted access to the TCP/IP
  stack.
  

Problem conclusion

• zSecure Audit has been modified, so that the RACF z/OS CIS 6.5.6
  compliance control provided by zSecure Audit reports IDs that
  are permitted access to the TCP/IP stack and are listed in
  customization member STACKACC as compliant. A separate DOMAIN
  and RULE have been introduced in the RACF z/OS CIS 6.5.6
  compliance control to handle access checks for IDs listed in the
  STACKACC customization member.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UJ97860

Modules/Macros

• CKAHR656 CKAIRULE
  

Fix information

• Fixed component name

  ZSEC BASE,ADMIN

• Fixed component ID

  5655T0100

Applicable component levels

• R310 PSY UJ97860

     UP25/08/22 P F508

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.