eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

CA LDAP Server for z/OS and OS/390OS/390 V2R7 and AboveIf you attempt to access an MVS data set that represents a hierarchical file system(HFS) through ISPF 3.2 or 3.4, it is possible that you will get an "OBTAIN failed"message. The extended message reads:…"datasetname has unknown attributes, OBTAIN RC = 12 hex".This will occur if the HFS data set is not mounted to OMVS. This can occur onOS/390 2.7 and higher systems. When data set information is requested for anunmounted HFS data set, OS/390 UNIX services will write information to the/tmp directory. If the user making the request does not have write access, theerror message is displayed. To avoid this error, you must ensure that the publicaccess permission for the /tmp directory is set to allow all access. The permissionbits for the /tmp directory should be set to 777 to allow all access.CA LDAP Server for z/OS and OS/390eTrust CA-Top Secret permits secured access to user information throughstandard LDAP protocols. For example, an LDAP session can query, delete, add,and modify information including user-defined fields stored within the eTrustCA-Top Secret acid record. CA clients are able to take advantage of these LDAPcapabilities using the CA supplied LDAP-compliant directory server for thez/OS and OS/390 platform. The CA LDAP Server for z/OS and OS/390 includesthese capabilities:■■■■■■Integration with CA Common Services for z/OS and OS/390Access control for directory informationStrong LDAP server authenticationInteroperability with both CA and third party LDAP clientsA high-performance repositoryIntegration with the CA eTrust Solution SuiteOpenEdition MVS / UNIX System Services SupportIn distributed environments where users move across hardware platforms andoperating systems to access multiple n-tier applications, security is a majorconcern. Sites want and need the same control over, and accountability for, dataand resources accessed in an open system as they are used to having in theirmainframe environment.1–6 Cookbook

OpenEdition MVS / UNIX System Services SupportEach z/OS and OS/390 release has included new and more robust versions ofUNIX System Services (USS). Initially called OpenEdition by IBM, these servicesallow UNIX applications to run on a z/OS or OS/390 mainframe. Since, theirinitial appearance in MVS 5.2.2, eTrust CA-Top Secret has provided the ability toperform the UNIX security administration necessary to manage these servicesand the UNIX file system. Beyond the base requirements to support thisenvironment, eTrust CA-Top Secret provides powerful trace and reportingfunctions that allow you to audit UNIX security events.UNIX security is based on users and groups having a unique binary identifier, aUserID (UID) or a GroupID (GID). eTrust CA-Top Secret lets you to define UIDsand GIDs and give them to those users needing UNIX services. Additionally,eTrust CA-Top Secret provides the support to secure access to the UNIX filesystem.Specifically, eTrust CA-Top Secret supports the following services in a UNIXSystem Services z/OS or OS/390 environment:■■■■■■■■Callable servicesHierarchical File System (HFS)Userid (UID) and Groupid (GID) definitionsHome and Path definitionsUNIX System Services AuditingUNIX System Services Security Trace FacilityUNIX System Services MVS Shell Setup Utility (ISHELL)Digital CertificatesThis section discusses eTrust CA-Top Secret support for UNIX System Services(USS). Specifically, it covers these topics:■■■■■■■Acids needed to install UNIX System Services MVSDefining a default UID and GIDControlling access to UNIX System ServicesControlling access to the Hierarchical File SystemeTrust CA-Top Secret records for UNIX System ServicesLogging UNIX System Services MVS security callsTracing UNIX System ServicesFor explanations and syntax of eTrust CA-Top Secret command functions, seethe Command Functions Guide. For details on the reporting facility available witheTrust CA-Top Secret, see the Report and Tracking Guide.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–7

<strong>CA</strong> LDAP Server <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390<strong>OS</strong>/390 V2R7 <strong>and</strong> AboveIf you attempt to access an MVS data set that represents a hierarchical file system(HFS) through ISPF 3.2 or 3.4, it is possible that you will get an "OBTAIN failed"message. The extended message reads:…"datasetname has unknown attributes, OBTAIN RC = 12 hex".This will occur if the HFS data set is not mounted to OMVS. This can occur on<strong>OS</strong>/390 2.7 <strong>and</strong> higher systems. When data set in<strong>for</strong>mation is requested <strong>for</strong> anunmounted HFS data set, <strong>OS</strong>/390 UNIX services will write in<strong>for</strong>mation to the/tmp directory. If the user making the request does not have write access, theerror message is displayed. To avoid this error, you must ensure that the publicaccess permission <strong>for</strong> the /tmp directory is set to allow all access. The permissionbits <strong>for</strong> the /tmp directory should be set to 777 to allow all access.<strong>CA</strong> LDAP Server <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390<strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> permits secured access to user in<strong>for</strong>mation throughst<strong>and</strong>ard LDAP protocols. For example, an LDAP session can query, delete, add,<strong>and</strong> modify in<strong>for</strong>mation including user-defined fields stored within the <strong>eTrust</strong><strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> acid record. <strong>CA</strong> clients are able to take advantage of these LDAPcapabilities using the <strong>CA</strong> supplied LDAP-compliant directory server <strong>for</strong> thez/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 plat<strong>for</strong>m. The <strong>CA</strong> LDAP Server <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 includesthese capabilities:■■■■■■Integration with <strong>CA</strong> Common Services <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390Access control <strong>for</strong> directory in<strong>for</strong>mationStrong LDAP server authenticationInteroperability with both <strong>CA</strong> <strong>and</strong> third party LDAP clientsA high-per<strong>for</strong>mance repositoryIntegration with the <strong>CA</strong> <strong>eTrust</strong> Solution SuiteOpenEdition MVS / UNIX System Services SupportIn distributed environments where users move across hardware plat<strong>for</strong>ms <strong>and</strong>operating systems to access multiple n-tier applications, security is a majorconcern. Sites want <strong>and</strong> need the same control over, <strong>and</strong> accountability <strong>for</strong>, data<strong>and</strong> resources accessed in an open system as they are used to having in theirmainframe environment.1–6 Cookbook

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!