eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

HFSSEC Control OptionThe exit can use this exit function to make any specific modifications to the pathname beyond that already performed by CA SAF HFS security processing.TroubleshootingThe following section discusses troubleshooting solutions.ReportingReporting is done through the existing eTrust CA-Top Secret resource report,TSSUTIL. When the AUDIT attribute is on the user’s acid or specificpermissions, audit records can also appear on the report if they are requested inthe report criteria. The report will show the translated name of the HFS file usedfor validation. TSSUTIL should be reviewed when researching validationproblems.In addition, the online real-time monitor TSSTRACK can also be used to monitorHFS file security related events.OPTIONS(32)Control option, OPTIONS(32), provides support for USS event logging to the AuditTracking File.To take advantage of this feature, the LONG option must be specified inTSSUTIL. This will ensure that the full 256-character resource name can bedisplayed. Logging will only take place for the acids that have the AUDIT orTRACE attributes assigned.A new RDT class called USSLOG is introduced with this new USSLOG feature.This will allow TSSUTIL to select USSLOG records with the RESCLASS(USSLOG) option and to report the access level for the USS event. All of therecords are displayed as a resource type of USSLOG.The resource name field will display the USS function, i.e., INIT_USP and forsome types of USS events, i.e., CHECK_ACCESS, the path name and file namebeing assessed. (In the example of the TSSUTIL report below, you can see howthe records are displayed)The TSSOERPT can still be used to get additional detailed information about theUSS event, such as UID, GID or group name. Otherwise TSSUTIL will nowcontain the event information such as: User ID’s, Modes, Function, Path Names,File Names, Return Code, Facility, etc. (See the example below to see how thetypical record are displayed). As part of CASAF, USS events are being logged toSMF as well.2–14 Cookbook

HFSSEC Control OptionDiagnosticsThe CA SAF HFS security interface can be traced by using the SECTRACEcommand. A trace of internal functions of CA SAF HFS security is enabledthrough use of the SECTRACE TYPE=HFS keyword. The trace output can berequested by technical support. The syntax is:SecTrace SET,TYPE=HFSThe following keywords are meaningful when TYPE=HFS is specified:ID=JOBname=USERid=ENable|DISableACTION=MATCHLIM=DEST=CONSOLE|JOBLOG|SYSLOGCONSid=MSGid|NOMSGidOther keywords are ignored. If DEST is not specified, the default isDEST=SYSLOG.The SAF validation calls invoked by CA SAF HFS security can also be traced.These SAF calls are the file and function validations that are passed to eTrustCA-Top Secret. Enable this tracing by first issuing the SECTRACE SETcommand detailed below, followed by a reply to the prompt:ST SET,ID=id,TYPE=SAFP,DEST=dest,ENDR nn,REQSTOR=SAFHFSEC,ENDTSSUTIL/SAF Reference TablesAt OS/390 Release 2.8 and above, results from running a TSSUTIL and a SAFSECTRACE are different when the HFSSEC control option is set to ON or OFF.The tables should be used as a reference when you are evaluating the results ofthese utilities.Controlling Access to the Hierarchical File System 2–15

HFSSEC Control OptionDiagnosticsThe <strong>CA</strong> SAF HFS security interface can be traced by using the SECTRACEcomm<strong>and</strong>. A trace of internal functions of <strong>CA</strong> SAF HFS security is enabledthrough use of the SECTRACE TYPE=HFS keyword. The trace output can berequested by technical support. The syntax is:SecTrace SET,TYPE=HFSThe following keywords are meaningful when TYPE=HFS is specified:ID=JOBname=USERid=ENable|DISableACTION=MATCHLIM=DEST=CONSOLE|JOBLOG|SYSLOGCONSid=MSGid|NOMSGidOther keywords are ignored. If DEST is not specified, the default isDEST=SYSLOG.The SAF validation calls invoked by <strong>CA</strong> SAF HFS security can also be traced.These SAF calls are the file <strong>and</strong> function validations that are passed to <strong>eTrust</strong><strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>. Enable this tracing by first issuing the SECTRACE SETcomm<strong>and</strong> detailed below, followed by a reply to the prompt:ST SET,ID=id,TYPE=SAFP,DEST=dest,ENDR nn,REQSTOR=SAFHFSEC,ENDTSSUTIL/SAF Reference TablesAt <strong>OS</strong>/390 Release 2.8 <strong>and</strong> above, results from running a TSSUTIL <strong>and</strong> a SAFSECTRACE are different when the HFSSEC control option is set to ON or OFF.The tables should be used as a reference when you are evaluating the results ofthese utilities.Controlling Access to the Hierarchical File System 2–15

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!