WebSphere MQ connection class resource definitions must be protected in accordance with security.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-224559	SRG-OS-000080	ZWMQ0052	SV-224559r1070084_rule	2025-02-24	7

Description
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

ℹ️ Check
Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQCONN) Review the following connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED, ensure the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. If all of the items above are true, this is not a finding. If any item above is untrue, this is a finding.

ℹ️ Check

Refer to the following reports produced by the RACF Data Collection: - SENSITVE.RPT(MQCONN) Review the following connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED, ensure the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. If all of the items above are true, this is not a finding. If any item above is untrue, this is a finding.

✔️ Fix
Review the following connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. A set of sample commands is provided below to implement the minimum profiles necessary for proper security. Note that the IMS and/or CICS profiles can be omitted if those products do not run on the target system. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS / RDEF MQCONN * UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE') RDEF MQCONN <ssid>.BATCH UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READAUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.BATCH CL(MQCONN) ID(<applicableTSO&batchUsers>) RDEF MQCONN <ssid>.CICS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.CICS CL(MQCONN) ID(<CICSRegionUserids>) RDEF MQCONN <ssid>.IMS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.IMS CL(MQCONN) ID(<IMSRegionUserids>) RDEF MQCONN <ssid>.CHIN UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.CHIN CL(MQCONN) ID(<WebsphereMQCHINUsrids>) SETR RACL(MQCONN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager Named QMD1: >QMD1 REFRESH SECURITY(*)

✔️ Fix

Review the following connection resources defined to the MQCONN resource class or MXCONN resource class if SCYCASE is set to MIXED: Resource Authorized Users ssid.BATCH TSO and batch job userids ssid.CICS CICS region userids ssid.IMS IMS region userids ssid.CHIN Channel initiator userids Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: Note: If a resource profile is not defined for a particular security check, and a user issues a request that would involve making that check, MQSeries/WebSphere MQ denies access. 1. Resource profiles are defined with a UACC(NONE). 2. Access authorization to these connections restricts access to the appropriate users as indicated above. 3. All access FAILUREs are logged. A set of sample commands is provided below to implement the minimum profiles necessary for proper security. Note that the IMS and/or CICS profiles can be omitted if those products do not run on the target system. /* THE FOLLOWING PROFILE FORCES GRANULAR PROFILES DEFINITIONS */ RDEF MQCONN ** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('MQCONN DENY-BY-DEFAULT PROFILE') RDEF MQCONN <ssid>.BATCH UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READAUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.BATCH CL(MQCONN) ID(<applicableTSO&batchUsers>) RDEF MQCONN <ssid>.CICS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.CICS CL(MQCONN) ID(<CICSRegionUserids>) RDEF MQCONN <ssid>.IMS UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.IMS CL(MQCONN) ID(<IMSRegionUserids>) RDEF MQCONN <ssid>.CHIN UACC(NONE) OWNER(ADMIN) AUDIT(FAILURES(READ)) DATA('REQUIRED FOR ZWMQ0052') PE <ssid>.CHIN CL(MQCONN) ID(<WebsphereMQCHINUsrids>) SETR RACL(MQCONN) REF Note that an additional WebSphere MQ Refresh may be required for active queue managers. This is done from the CONSOLE: The example is for a queue manager Named QMD1: >QMD1 REFRESH SECURITY(*)