eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Controlling HFS Using CA SAF HFS SecurityHFSSEC Resource ClassCA SAF HFS security introduces a new pre-defined resource class calledHFSSEC. This new RESCLASS is used when defining file and directory levelaccess in eTrust CA-Top Secret.Permission ConsiderationsThis section describes special considerations to be taken into account whenadministering permits for HFS resources.In addition to access to HFS files, users can also need access to directories. Auser requires READ access to a directory in order to list the contents of thatdirectory. When writing a permission, you distinguish a directory permit from afile permit by not using a trailing period in the HFSSEC authorization. Forexample, the permits used to allow users to read the /BIN directory, but onlyallow EXECUTE access to the files contained within the directory is:TSS PER(ALL) HFSSEC(/BIN) ACCESS(READ)TSS PER(ALL) HFSSEC(/BIN.) ACCESS(EXEC)The root directory is defined by the single character (/). With eTrust CA-TopSecret the root directory must be owned using the special name ROOT. Filescontained in the root directory (/) must be specified as the slash (/) followed bythe file name. Therefore, the only valid permit for the ROOT directory (/) is thatwhich allows read access to the directory itself. The following shows the permitrequired for the root directory and a permit that allows read and write access tofile rootfile:TSS PER(ALL) HFSSEC(ROOT) ACCESS(READ)TSS PER(ALL) HFSSEC(/ROOTFILE) ACCESS(UPDATE)Permits administered to secure HFS file resources should specify the ACCESSkeyword to identify the type of access to the file. If the access keyword is notused, READ access is implied. The access keywords and their meanings follow:KeywordEXECUTEREADUPDATEALTERDescriptionAllows execute access to a file, usually a program file.Allows read access to a file.Allows write access to a file.Allows create and delete access to a file.2–6 Cookbook
Securing HFS FunctionsKeywordALLCONTROLDescriptionAllows all of the above.A special access not used for normal file accessvalidation. This is used with HFS function security toallow a user to change file attributes. Moreinformation can be found in the following section.ReportingAudit records created by HFS file access checks, (i.e., violations, and auditevents) are written to the Audit Tracking File and accessed by the TSSUTILreport utility. TSSUTIL integrates these events among other events according tothe report generation criteria.Securing HFS FunctionsIn addition to file access security, HFS functions can also be secured. Thesefunctions can be a system action, such as setting a ptrace or a job’s priority, orthey can be file-related, such as changing the file mode or audit settings.A system function is secured by a rule in the IBMFAC class, while a file-relatedfunction is secured by a combination of an IBMFAC class rule and a HFS fileresource rule. By following this approach, changes to file attributes can bepermitted at a global basis, or restricted to a particular file.The resource name format for HFS IBMFAC rules is: BPX.CAHFS.function. Anexample of a permission would be:TSS PER(USER01) IBMFAC(BPX.CAHFS.function) ACCESS(READ)System FunctionsIn order to perform a system function, the user requires READ access to thecorresponding IBMFAC.Controlling Access to the Hierarchical File System 2–7
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
- Page 69 and 70: Digital Certificate SupportNote: In
- Page 71 and 72: Digital Certificate SupportYou can
- Page 73 and 74: Digital Certificate SupportCase #2.
- Page 75 and 76: Digital Certificate SupportImportan
- Page 77 and 78: Digital Certificate SupportAdding a
- Page 79 and 80: Digital Certificate SupportReconnec
- Page 81 and 82: Digital Certificate SupportTSS LIST
- Page 83 and 84: Certificate Name Filtering SupportT
- Page 85 and 86: Certificate Name Filtering SupportI
- Page 87 and 88: Certificate Name Filtering SupportD
- Page 89 and 90: Certificate Name Filtering SupportL
- Page 91 and 92: KerberosKerberosetrust CA-Top Secre
- Page 93 and 94: KerberosThe command syntax for this
- Page 95 and 96: KerberosThe following command creat
- Page 97 and 98: Mapping of Foreign EnvironmentsMapp
- Page 99 and 100: Mapping of Foreign EnvironmentsMapp
- Page 101 and 102: Distributed File Server SMB SUPPORT
- Page 103 and 104: NFS (Network File System)The first
- Page 105 and 106: z/OS and OS/390 Security Server Sup
- Page 107 and 108: z/OS and OS/390 Security Server Sup
- Page 109 and 110: z/OS and OS/390 Security Server Sup
- Page 111 and 112: Chapter2Controlling Access to theHi
- Page 113 and 114: Controlling HFS Using the Native UN
- Page 115: Controlling HFS Using CA SAF HFS Se
- Page 119 and 120: Securing HFS FunctionsFile Function
- Page 121 and 122: Implementing CA SAF HFS SecurityImp
- Page 123 and 124: HFSSEC Control Option+12—The addr
- Page 125 and 126: HFSSEC Control OptionDiagnosticsThe
- Page 127 and 128: HFSSEC Control OptionUNIX CMDCHMOD(
- Page 129 and 130: HFSSEC Control OptionTSSSUTIL EQUIV
- Page 131 and 132: HFSSEC Control OptionUNIX CMDS ACCE
- Page 133 and 134: HFSSEC Control OptionExample 1// JO
- Page 135 and 136: HFSSEC Control OptionExample 2// JO
- Page 137 and 138: MessagesMessagesCAS2301EEVENT PROCE
- Page 139 and 140: MessagesCAS2306Wxxxxxxxxxxxxxxx EVE
- Page 141: MessagesCAS2319ITRACEID=aaaaaaaa US
- Page 144 and 145: The SYSPLEX XES FunctionThere are t
- Page 146 and 147: eTrust CA-Top Secret and the SYSPLE
- Page 148 and 149: Defining the Sysplex to eTrust CA-T
- Page 150 and 151: Managing the Coupling FacilityWhen
- Page 152 and 153: Defining SYSTEM LOGGER to eTrust CA
- Page 154 and 155: IMVSECUR/*=========================
- Page 156 and 157: IMVSECUR/*=========================
- Page 158 and 159: IMVSECURFeature RACF eTrust CA-Top
- Page 160 and 161: PERMITIn eTrust CA-Top Secret, all
- Page 163 and 164: Indexcomponent names for z/OS and O
- Page 165 and 166: OpenEdition MVS supportACIDs needed
Controlling HFS Using <strong>CA</strong> SAF HFS <strong>Security</strong>HFSSEC Resource Class<strong>CA</strong> SAF HFS security introduces a new pre-defined resource class calledHFSSEC. This new RESCLASS is used when defining file <strong>and</strong> directory levelaccess in <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>.Permission ConsiderationsThis section describes special considerations to be taken into account whenadministering permits <strong>for</strong> HFS resources.In addition to access to HFS files, users can also need access to directories. Auser requires READ access to a directory in order to list the contents of thatdirectory. When writing a permission, you distinguish a directory permit from afile permit by not using a trailing period in the HFSSEC authorization. Forexample, the permits used to allow users to read the /BIN directory, but onlyallow EXECUTE access to the files contained within the directory is:TSS PER(ALL) HFSSEC(/BIN) ACCESS(READ)TSS PER(ALL) HFSSEC(/BIN.) ACCESS(EXEC)The root directory is defined by the single character (/). With <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong><strong>Secret</strong> the root directory must be owned using the special name ROOT. Filescontained in the root directory (/) must be specified as the slash (/) followed bythe file name. There<strong>for</strong>e, the only valid permit <strong>for</strong> the ROOT directory (/) is thatwhich allows read access to the directory itself. The following shows the permitrequired <strong>for</strong> the root directory <strong>and</strong> a permit that allows read <strong>and</strong> write access tofile rootfile:TSS PER(ALL) HFSSEC(ROOT) ACCESS(READ)TSS PER(ALL) HFSSEC(/ROOTFILE) ACCESS(UPDATE)Permits administered to secure HFS file resources should specify the ACCESSkeyword to identify the type of access to the file. If the access keyword is notused, READ access is implied. The access keywords <strong>and</strong> their meanings follow:KeywordEXECUTEREADUPDATEALTERDescriptionAllows execute access to a file, usually a program file.Allows read access to a file.Allows write access to a file.Allows create <strong>and</strong> delete access to a file.2–6 Cookbook
Change language