eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

z/OS and OS/390 Security Server Support4. Define additional started tasks used by the firewall daemons:TSS ADD(STC) PROCNAME(ICAPSLOG) ACID(FWKERN)TSS ADD(STC) PROCNAME(ICAPSOCK) ACID(FWKERN)TSS ADD(STC) PROCNAME(ICAPPFTP) ACID(FWKERN)TSS ADD(STC) PROCNAME(ICAPFLOG) ACID(FWKERN)TSS ADD(STC) PROCNAME(ICAPTNAT) ACID(FWKERN)5. Permit FWKERN access to READ the TCP/IP data sets:TSS PERMIT(FWKERN) DSN(TCPIP.*) ACCESS(READ)The high level qualifier of these data sets might have been renamed from“TCPIP” when installed on your system.6. Permit the FWKERN acid to the SMF logging facility:TSS PERMIT(FWKERN) IBMFAC(BPX.SMF) ACCESS(READ)7. Permit the PFTP server to the BPX.DAEMON facility:TSS PERMIT(FWKERN) IBMFAC(BPX.DAEMON) ACCESS(READ)8. Adding Firewall Administrators to FWGRP:Firewall administrators must be members of the group FWGRP or havesuperuser authority. The following command gives an administrator thefirewall group:TSS ADD(administrator) GROUP(FWGRP)9. Firewall Technologies has the ability to invoke z/OS and OS/390 IntegratedCryptographic facilities to perform internal security functions. These servicesare protected using the resource class CSFSERV. Users must be permitted tothe individual services necessary. This is accomplished using the followingcommands:TSS ADD(dept) CSFSERV(service-name)TSS PERMIT(acid) CSFSERV(service-name) ACCESS(READ)The individual service-names are documented in the appropriate IBMFirewall manuals and the ICSF/MVS Administrators Guide.LDAP ServerIBM provides a Lightweight Directory Access Protocol (LDAP) Server with z/OSand OS/390 releases 2.5 and above. This server can be used to store directoryinformation, such as email accounts. The LDAP server uses a DB2-based file tostore directory information.1–98 Cookbook