eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
WLM (Workload Management)OS/390 NFS NSM (Network Status Monitor)TSS CREATE(MVSNSM) NAME('NFS NSM') DEPT(dept)TYPE(USER) PASS(password,0) FAC(STC)TSS ADD(MVSNSM) NODSNCHK **or per all required data sets**TSS ADD(MVSNSM) UID(0) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)TSS PER(MVSNSM) DSN( per all required data sets )TSS ADD(MVSNSM) SOURCE(INTRDR)Add Procedures to STC acidTSS ADD(STC) PROCN(MVSNFS) ACID(MVSNFS)TSS ADD(STC) PROCN(MVSLOCKD) ACID(MVSNLM)TSS ADD(STC) PROCN(MVSSTATD) ACID(MVSNSM)TSS ADD(STC) PROCN(MVSNFSC) ACID(MVSNFSC)WLM (Workload Management)The WLM ISPF application is protected by a SAF call. Access to the WLM ISPFapplication is controlled through the definition of a facility class in eTrustCA-Top Secret. READ or UPDATE access to the entire WLM service definition isthe only option available through the eTrust CA-Top Secret facility accessauthorization. READ access allows users access to all functions except installingand activating a service definition or policy.Specify an access of NONE for the facility resource. Also, limit the number ofusers authorized to read and update the WLM application to those who maintainthe WLM policy, to performance personnel, or to both. Review the requirementfor operations to have access to install a service definition versus activating anexisting policy.To authorize the facility for WLM, execute the following eTrust CA-Top Secretcommands:TSS ADD(deptacid) IBMFAC(MVSADMIN)—Skip this command if already ownedTSS PER(aicd) IBMFAC(MVSADMIN.WLM.POLICY) ACC(READ)orTSS PER(acid) IBMFAC(MVSADMIN.WLM.POLICY) ACC(UPDATE)z/OS and OS/390 Security Server SupportIBM markets the Security Server as a separate offering, along with z/OS andOS/390. This offering is a bundling of RACF with a number of other products.All of these products perform some security (SAF) function. Those that interfacewith RACF, do so through standard security calls, supported by eTrust CA-TopSecret. None are truly dependent on RACF to function. The followingcomponents make up the Security Server.1–94 Cookbook
z/OS and OS/390 Security Server SupportRACFAlthough delivered as part of the Security Server, RACF must be independentlyactivated, and is not required to run the other Security Server components. RACFis IBM’s SAF compliant security system. It is mainly concerned with system entryvalidation and resource permission. It provides no subsystem specific extensionsto secure such things as partitioned data sets, CICS and IMS. Typically, in RACFphilosophy, these sorts of extensions are available as user maintained exit points.Its reporting and administration capabilities are limited, typically these functionsmust be supplemented by buying additional third party products.To disable RACF, update the appropriate IFAPRDxx member and change the STATEfield to:STATE(DISABLED)Then re-IPL the system to make the change take effect.For example, if you ordered RACF as part of the security server for z/OS and OS/390,and you want to disable the security server, update the IFAPRDxx entry to look like this:PRODUCT OWNER('IBM CORP')NAME('z/OS and OS/390')FEATURENAME('Security Server')ID(5647-A01)VERSION(*)RELEASE(*)MOD(*)STATE(DISABLED)If you ordered RACF as part of the security server for z/OS and OS/390, and want todisable the RACF component of the security server but continue to use the DCEcomponent of the security server, update the IFAPRDxx entries to look like this:PRODUCT OWNER('IBM CORP')NAME('z/OS and OS/390')FEATURENAME('Security Server')ID(5647-A01)VERSION(*)RELEASE(*)MOD(*)STATE(ENABLED)PRODUCT OWNER('IBM CORP')NAME('z/OS and OS/390')FEATURENAME('RACF')ID(5647-A01)VERSION(*)RELEASE(*)MOD(*)STATE(DISABLED)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–95
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
- Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
- Page 59 and 60: Lotus Domino Go WebserverTo disable
- Page 61 and 62: Lotus Notes and Novell Directory Se
- Page 63 and 64: Digital Certificate SupportGeneral
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
- Page 69 and 70: Digital Certificate SupportNote: In
- Page 71 and 72: Digital Certificate SupportYou can
- Page 73 and 74: Digital Certificate SupportCase #2.
- Page 75 and 76: Digital Certificate SupportImportan
- Page 77 and 78: Digital Certificate SupportAdding a
- Page 79 and 80: Digital Certificate SupportReconnec
- Page 81 and 82: Digital Certificate SupportTSS LIST
- Page 83 and 84: Certificate Name Filtering SupportT
- Page 85 and 86: Certificate Name Filtering SupportI
- Page 87 and 88: Certificate Name Filtering SupportD
- Page 89 and 90: Certificate Name Filtering SupportL
- Page 91 and 92: KerberosKerberosetrust CA-Top Secre
- Page 93 and 94: KerberosThe command syntax for this
- Page 95 and 96: KerberosThe following command creat
- Page 97 and 98: Mapping of Foreign EnvironmentsMapp
- Page 99 and 100: Mapping of Foreign EnvironmentsMapp
- Page 101 and 102: Distributed File Server SMB SUPPORT
- Page 103: NFS (Network File System)The first
- Page 107 and 108: z/OS and OS/390 Security Server Sup
- Page 109 and 110: z/OS and OS/390 Security Server Sup
- Page 111 and 112: Chapter2Controlling Access to theHi
- Page 113 and 114: Controlling HFS Using the Native UN
- Page 115 and 116: Controlling HFS Using CA SAF HFS Se
- Page 117 and 118: Securing HFS FunctionsKeywordALLCON
- Page 119 and 120: Securing HFS FunctionsFile Function
- Page 121 and 122: Implementing CA SAF HFS SecurityImp
- Page 123 and 124: HFSSEC Control Option+12—The addr
- Page 125 and 126: HFSSEC Control OptionDiagnosticsThe
- Page 127 and 128: HFSSEC Control OptionUNIX CMDCHMOD(
- Page 129 and 130: HFSSEC Control OptionTSSSUTIL EQUIV
- Page 131 and 132: HFSSEC Control OptionUNIX CMDS ACCE
- Page 133 and 134: HFSSEC Control OptionExample 1// JO
- Page 135 and 136: HFSSEC Control OptionExample 2// JO
- Page 137 and 138: MessagesMessagesCAS2301EEVENT PROCE
- Page 139 and 140: MessagesCAS2306Wxxxxxxxxxxxxxxx EVE
- Page 141: MessagesCAS2319ITRACEID=aaaaaaaa US
- Page 144 and 145: The SYSPLEX XES FunctionThere are t
- Page 146 and 147: eTrust CA-Top Secret and the SYSPLE
- Page 148 and 149: Defining the Sysplex to eTrust CA-T
- Page 150 and 151: Managing the Coupling FacilityWhen
- Page 152 and 153: Defining SYSTEM LOGGER to eTrust CA
WLM (Workload Management)<strong>OS</strong>/390 NFS NSM (Network Status Monitor)TSS CREATE(MVSNSM) NAME('NFS NSM') DEPT(dept)TYPE(USER) PASS(password,0) FAC(STC)TSS ADD(MVSNSM) NODSNCHK **or per all required data sets**TSS ADD(MVSNSM) UID(0) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)TSS PER(MVSNSM) DSN( per all required data sets )TSS ADD(MVSNSM) SOURCE(INTRDR)Add Procedures to STC acidTSS ADD(STC) PROCN(MVSNFS) ACID(MVSNFS)TSS ADD(STC) PROCN(MVSLOCKD) ACID(MVSNLM)TSS ADD(STC) PROCN(MVSSTATD) ACID(MVSNSM)TSS ADD(STC) PROCN(MVSNFSC) ACID(MVSNFSC)WLM (Workload Management)The WLM ISPF application is protected by a SAF call. Access to the WLM ISPFapplication is controlled through the definition of a facility class in <strong>eTrust</strong><strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>. READ or UPDATE access to the entire WLM service definition isthe only option available through the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> facility accessauthorization. READ access allows users access to all functions except installing<strong>and</strong> activating a service definition or policy.Specify an access of NONE <strong>for</strong> the facility resource. Also, limit the number ofusers authorized to read <strong>and</strong> update the WLM application to those who maintainthe WLM policy, to per<strong>for</strong>mance personnel, or to both. Review the requirement<strong>for</strong> operations to have access to install a service definition versus activating anexisting policy.To authorize the facility <strong>for</strong> WLM, execute the following <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>comm<strong>and</strong>s:TSS ADD(deptacid) IBMFAC(MVSADMIN)—Skip this comm<strong>and</strong> if already ownedTSS PER(aicd) IBMFAC(MVSADMIN.WLM.POLICY) ACC(READ)orTSS PER(acid) IBMFAC(MVSADMIN.WLM.POLICY) ACC(UPDATE)z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 <strong>Security</strong> Server SupportIBM markets the <strong>Security</strong> Server as a separate offering, along with z/<strong>OS</strong> <strong>and</strong><strong>OS</strong>/390. This offering is a bundling of RACF with a number of other products.All of these products per<strong>for</strong>m some security (SAF) function. Those that interfacewith RACF, do so through st<strong>and</strong>ard security calls, supported by <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong><strong>Secret</strong>. None are truly dependent on RACF to function. The followingcomponents make up the <strong>Security</strong> Server.1–94 Cookbook