eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

z/OS and OS/390 Security Server SupportSetting up the z/OS or OS/390 LDAP Server with eTrust CA-Top Secret involvesthe following steps:1. Create a group definition for use with the LDAP Server:TSS CREATE (LDAPGRP) TYPE(GROUP) NAME(‘LDAP Group’) DEPT(OMVSDEPT)TSS ADD(LDAPGRP) GID(nn)Any unused GID number is allowed.2. Define the LDAP Server startup address space identifier:TSS CREATE(LDAPSRV) TYPE(USER) NAME(‘LDAP Startup ID’)DEPT(OMVSDEPT) FACILITY(STC,BATCH) PASS(password,0)TSS ADD(LDAPSRV) GROUP(LDAPGRP) DFLTGRP(LDAPGRP)HOME(/) OMVSPGM(/bin/sh) UID(0)TSS ADD(STC) PROCNAME(LDAPSRV) ACID(LDAPSRV)TSS MODIFY(OMVSTABS)3. The acid for the LDAP server started task requires access to the followingIBMFAC resources:TSS ADD(anydept) IBMFAC(BPX.)TSS PERMIT(LDAPSRV) IBMFAC(BPX.DAEMON)TSS PERMIT(LDAPSRV) IBMFAC(BPX.SERVER)ACCESS(READ)ACCESS(UPDATE)DB2 Security ExitIn response to the fact that native DB2 only provides internal security, thesecurity server now provides sample code for a DB2 security exit. eTrust CA-TopSecret has offered for a number of years the ability to secure DB2 using eTrustCA-Top Secret for DB2. See the eTrust CA-Top Secret for DB2 ImplementationGuide for additional information.Integrated Cryptographic ServicesIBM has delivered as a hardware offering, a high powered cryptographiccoprocessor which allows z/OS or OS/390 applications to exploit cryptography.The z/OS or OS/390 Security Server provides API’s to invoke thesecryptographic services (ICSF) rather than use software algorithms to perform thesame functions. In addition, various functions involved with the management ofkeys are provided in this service. These services combine to provide a site withthe ability to manage public keys.eTrust CA-Top Secret provides the following resource classes to allow ICSF to besecured and audited.CSFKEYS—This class is used to secure encryption keys. The value, which isowned and permitted, is the key label. The key label is in the CKDS or PKDSwhen a key is defined.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–99