WebSphere MQ resource classes must be properly activated for security checking by the ESM.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224557	SRG-OS-000080	ZWMQ0049	SV-224557r1056162_rule	2025-02-24	7

Description
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

ℹ️ Check
Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) - DSMON.RPT(RACCDT) - Alternate list of active resource classes Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZWMQ0049) Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE If the classes noted above are not active, this is a finding. When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC If when SCYCASE is set to mixed, CLASMAP Definitions do not include the entries shown above, this is a finding. NOTE: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

ℹ️ Check

Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) - DSMON.RPT(RACCDT) - Alternate list of active resource classes Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZWMQ0049) Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE If the classes noted above are not active, this is a finding. When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC If when SCYCASE is set to mixed, CLASMAP Definitions do not include the entries shown above, this is a finding. NOTE: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed.

✔️ Fix
Ensure that all WebSphere MQ resources are active and properly defined. Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC NOTE: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed. The following sample contains commands to activate the required classes: SETR CLASSACT(MQADMIN MQCMDS MQCONN) SETR CLASSACT(MQNLIST MQPROC MQQUEUE) SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)

✔️ Fix

Ensure that all WebSphere MQ resources are active and properly defined. Ensure the following WebSphere MQ resource classes are active: GMQADMIN GMQNLIST GMQPROC GMQQUEUE MQADMIN MQCMDS MQCONN MQNLIST MQPROC MQQUEUE When SCYCASE is set to mixed, CLASMAP Definitions must include the following entries: GMXADMIN GMXNLIST GMXPROC GMXQUEUE GMXTOPIC MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC NOTE: If MQADMIN or MXADMIN resource classes are not active, no security checking is performed. The following sample contains commands to activate the required classes: SETR CLASSACT(MQADMIN MQCMDS MQCONN) SETR CLASSACT(MQNLIST MQPROC MQQUEUE) SETR CLASSACT(MXADMIN MXNLIST MXPROC MXQUEUE)