WebSphere MQ connection class resources must be protected in accordance with security.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224362	SRG-OS-000080	ZWMQ0052	SV-224362r1070008_rule	2025-02-24	7

Description
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

ℹ️ Check
Refer to the following report produced by the ACF2 Data Collection: - SENSITVE.RPT(MQCONN) - ACF2CMDS.RPT(RESOURCE) - Alternate report Review the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: 1. Access authorization to these connections restricts access to the appropriate users as indicated in (b). 2. All access FAILUREs are logged. If both of the above are true, this is not a finding. If either of the above is untrue, this is a finding.

ℹ️ Check

Refer to the following report produced by the ACF2 Data Collection: - SENSITVE.RPT(MQCONN) - ACF2CMDS.RPT(RESOURCE) - Alternate report Review the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: 1. Access authorization to these connections restricts access to the appropriate users as indicated in (b). 2. All access FAILUREs are logged. If both of the above are true, this is not a finding. If either of the above is untrue, this is a finding.

✔️ Fix
Ensure all connections to MQSeries/WebSphere MQ resources are restricted using connection security. Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: Access authorization to these connections restricts access to the appropriate users as indicated above. All access FAILURE is logged. Example: $KEY(ssid) TYPE(MQK) BATCH UID(STCssid) SERVICE(READ) BATCH UID(syspaudt) SERVICE(READ) BATCH UID() PREVENT CHIN UID(STCssidCHIN) SERVICE(READ) CHIN UID() PREVENT CICS UID() PREVENT IMS UID() PREVENT

✔️ Fix

Ensure all connections to MQSeries/WebSphere MQ resources are restricted using connection security. Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED): Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to TYPE(MQK), ensure the following items are in effect: Access authorization to these connections restricts access to the appropriate users as indicated above. All access FAILURE is logged. Example: $KEY(ssid) TYPE(MQK) BATCH UID(STCssid) SERVICE(READ) BATCH UID(syspaudt) SERVICE(READ) BATCH UID(*) PREVENT CHIN UID(STCssidCHIN) SERVICE(READ) CHIN UID(*) PREVENT CICS UID(*) PREVENT IMS UID(*) PREVENT