IBM Security Z Security

Security for Z

Join this online user group to communicate across Z Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  SITE_BANNER OPTION

    Posted Mon June 19, 2023 04:41 AM

    Hello everyone. I'm developing  compliance check for ftp banner whether BANNER statement has proper content. It look similar way:

    ALLOC TYPE=input dd=banner PATH='/xxxx/yyyyy/ftp.banner'
    OPTION site_banner=banner                            
    newlist type=IP_FTP_REGION nodup nopage retain       
    select complex=*                                     
    sortlist banner banner_match

    Unfortunately, from above query I get the banner_match - "No", what means something wrong with banner configuration. 

    I've checked - the file exists in USS ishell

    Is this something wrong with my query or banner file configuration within zSecure?

    I was following this documentation - STIG rules that require ALLOCATE and OPTION statements

    Preparation for CKACUST and CKACUSV members - IBM Documentation



    ------------------------------
    Viktorija Kulbaciauskiene
    ------------------------------


  • 2.  RE: SITE_BANNER OPTION

    Posted Mon June 19, 2023 05:04 AM

    Hi Viktorija,

    the documentation of the field BANNER_MATCH is as follows:

    This flag field shows whether each line, from the file that is specified with the SITE_BANNER OPTION,
    occurs in the first 64 KB of the welcome banner to be displayed immediately after a client connects to
    the FTP server. This welcome banner can be stored in a USS file, data set, or member and is specified
    on the FTP BANNER configuration statement. Leading and trailing blanks of a line are not included and
    the comparisons are case-insensitive. The field is missing when the file that contains the logon banner
    specification could not be opened, when the specified SITE_BANNER OPTION file cannot be opened,
    or when no such file was specified.

    Thus, according to my understanding, your outcome of "No"  for the BANNER_MATCH field indicates that not each line in the file that your have configured as the SITE_BANNER matches with the first 64 KB of the welcome banner to be displayed immediately after a client connects to the FTP server.



    ------------------------------
    Tom Zeehandelaar
    z/OS Security Enablement Specialist - zSecure developer
    IBM
    ------------------------------

    Original Message


  • 3.  RE: SITE_BANNER OPTION

    Posted Mon June 19, 2023 05:21 AM
    Edited by Rob van Hoboken Mon June 19, 2023 05:22 AM

    As Tom wrote, the contents of your file /xxxx/yyyyy/ftp.banner is used as a standard to check the actual FTP banner value.  zSecure looks in the actual FTP banner from CKFREEZE, and verifies that (values/keywords/phrases) from /xxxx/yyyyy/ftp.banner are included anywhere in the first 64 kbytes of the actual banner.

    What could go wrong?  ASCII/EBCDIC conversion in the UNIX file?  Single space vs double space?  Trailing line with garbage in the standard that is not in the actual banner?

    How to resolve? 

    • Try writing ONE WORD from the banner in your file /xxxx/yyyyy/ftp.banner and see if the BANNER_MATCH field changes.
    • Allocate to a PDS member or sequential data set, to ensure UNIX file ASCII/EBCDIC confusion is not at play.

    ------------------------------
    Rob van Hoboken
    ------------------------------



Related Content