eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
OpenEdition MVS / UNIX System Services SupportControlling Access to UNIX System ServicesWhen a user attempts to enter the UNIX System Services shell, eTrust CA-TopSecret verifies that the user is a USS user before the system initializes the shell.Before allowing access to the requested resource, eTrust CA-Top Secret alsoverifies that the user associated with a program attempting to access a USSresource is a USS user.To define an acid as an UNIX System Services user, you must:■■■■define the user to eTrust CA-Top Secretassign a UNIX System Services Groupassign a UNIX System Services UID to the userassign the user to a default groupHow to Define UNIX System Services UsersUNIX System Services recognizes acids by their assigned UID. UIDs can be anynumeric value from zero to 2,147,483,647. The OMVS segment of the acid definesan acid's UID, the user's home directory, and the initial program that the userwill run. The initial program is generally the shell program that the user invokes.The MSCA acid can not be used to sign on to USS.UID—A numeric keyword that accepts values from zero to 2,147,483,647. A UIDdefined with a value of zero indicates that this user is a superuser.This keyword must be unique to maintain individual accountability and control.A UID is required for all acids in UNIX System Services. eTrust CA-Top Secret willnot allow a UID to be given if it is already assigned to another acid. A UID(0) isthe only UID that can be given to more than one acid.HOME—Defines the initial directory pathname. This is the initial directory usedwhen a user enters the OMVS command or enters the ISPF shell. The HOMEkeyword accepts from one to 1024 characters. Both uppercase and lowercasecharacters are allowed. If HOME isn't defined, UNIX System Services sets theinitial directory for the user to the root directory. HOME is optional.OMVSPGM—Defines the user's UNIX System Services shell program. This isthe first program started when the OMVS command is entered or when an USSbatch job is started using the BPXBATCH program. The OMVSPGM keywordaccepts from one to 1024 characters. Both uppercase and lowercase characters areallowed. If OMVSPGM isn't entered, USS gives control to the default shellprogram. OMVSPGM is optional.1–8 Cookbook
OpenEdition MVS / UNIX System Services SupportThe following example shows how to define user OMVSUSR as a superuser.Since HOME and OMVSPGM aren't explicitly specified, the defaults are takenfor these fields.TSS ADD(OMVSUSR) UID(0)This example shows how to define user OMVSU2 as a regular user. The HOMEand PROGRAM keywords are also used.TSS ADD(OMVSU2) UID(199) HOME(/u/omvsu2) OMVSPGM(/bin/sh)SUPERUSER—A superuser passes all UNIX System Services security checksand, therefore, can access all UNIX files. An acid can become a superuser in oneof two ways:■or■Have a UID(0)Use the SU (switch user) command if resource IBMFAC(BPX.SUPERUSER)has been permitted to that user.Other than the required started task acids, the only acids requiring a UID(0) arethe system programmers responsible for installing USS. All other acids shouldhave a non-zero UID and be permitted the necessary authorities in the classIBMFAC plus file permissions. The eTrust CA-Top Secret resource class IBMFACis equivalent to the IBM FACILITY class.How to Define UNIX System Services GroupsUNIX System Services security is based on user and group ownership of filesand processes. eTrust CA-Top Secret uses the DFLTGRP and GROUP fields ofthe acid record to assign the user to a UNIX System Services group.eTrust CA-Top Secret requires that the UID be unique for each acid (except UID0) and that the GID is unique for each group acid. (Only UID 0 can be assigned tomore than one acid.)The GROUP type acid defines UNIX System Services groups to eTrust CA-TopSecret. The GROUP type acid contains the OMVS segment, which consists of onefield: the GID keyword.GID is a numeric field that accepts values from zero to 2,147,483,647. This valuemust be unique to maintain control over a particular group. You can assign up to256 groups to a user, using the GROUP field.The following example shows how to create an OMVS GROUP acid for a groupcalled OMVSGRP and assign it a GID of 1.TSS CREATE(OMVSGRP) TYPE(GROUP) NAME(‘OMVSGROUP’) DEPT(OMVSDEPT)TSS ADD(OMVSGRP) GID(1)At least one OMVS group acid must exist prior to implementation.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–9
- Page 1 and 2: eTrust CA-Top Secret ® Securityfo
- Page 3: Technical UpdatesMay 2003The follow
- Page 6 and 7: Superuser Granularity .............
- Page 8 and 9: WLM (Workload Management)..........
- Page 11 and 12: Chapter1Implementing eTrust CA-TopS
- Page 13 and 14: z/OS and OS/390 CompatibilityThe li
- Page 15 and 16: z/OS and OS/390 Release-Specific Se
- Page 17: OpenEdition MVS / UNIX System Servi
- Page 21 and 22: OpenEdition MVS / UNIX System Servi
- Page 23 and 24: OpenEdition MVS / UNIX System Servi
- Page 25 and 26: OpenEdition MVS / UNIX System Servi
- Page 27 and 28: OpenEdition MVS / UNIX System Servi
- Page 29 and 30: OpenEdition MVS / UNIX System Servi
- Page 31 and 32: Tracing UNIX System Services (OMVS)
- Page 33 and 34: Tracing UNIX System Services (OMVS)
- Page 35 and 36: Tracing UNIX System Services (OMVS)
- Page 37 and 38: Tracing UNIX System Services (OMVS)
- Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
- Page 41 and 42: Using TCP/IPwheresysname is the nam
- Page 43 and 44: Using FTPHow to Secure FTPFTP runs
- Page 45 and 46: Using TELNETTerminal Source Restric
- Page 47 and 48: WebSphere Application Server for z/
- Page 49 and 50: WebSphere Application Server for z/
- Page 51 and 52: WebSphere Application Server for z/
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
- Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
- Page 59 and 60: Lotus Domino Go WebserverTo disable
- Page 61 and 62: Lotus Notes and Novell Directory Se
- Page 63 and 64: Digital Certificate SupportGeneral
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
OpenEdition MVS / UNIX System Services SupportControlling Access to UNIX System ServicesWhen a user attempts to enter the UNIX System Services shell, <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong><strong>Secret</strong> verifies that the user is a USS user be<strong>for</strong>e the system initializes the shell.Be<strong>for</strong>e allowing access to the requested resource, <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> alsoverifies that the user associated with a program attempting to access a USSresource is a USS user.To define an acid as an UNIX System Services user, you must:■■■■define the user to <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>assign a UNIX System Services Groupassign a UNIX System Services UID to the userassign the user to a default groupHow to Define UNIX System Services UsersUNIX System Services recognizes acids by their assigned UID. UIDs can be anynumeric value from zero to 2,147,483,647. The OMVS segment of the acid definesan acid's UID, the user's home directory, <strong>and</strong> the initial program that the userwill run. The initial program is generally the shell program that the user invokes.The MS<strong>CA</strong> acid can not be used to sign on to USS.UID—A numeric keyword that accepts values from zero to 2,147,483,647. A UIDdefined with a value of zero indicates that this user is a superuser.This keyword must be unique to maintain individual accountability <strong>and</strong> control.A UID is required <strong>for</strong> all acids in UNIX System Services. <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> willnot allow a UID to be given if it is already assigned to another acid. A UID(0) isthe only UID that can be given to more than one acid.HOME—Defines the initial directory pathname. This is the initial directory usedwhen a user enters the OMVS comm<strong>and</strong> or enters the ISPF shell. The HOMEkeyword accepts from one to 1024 characters. Both uppercase <strong>and</strong> lowercasecharacters are allowed. If HOME isn't defined, UNIX System Services sets theinitial directory <strong>for</strong> the user to the root directory. HOME is optional.OMVSPGM—Defines the user's UNIX System Services shell program. This isthe first program started when the OMVS comm<strong>and</strong> is entered or when an USSbatch job is started using the BPXBATCH program. The OMVSPGM keywordaccepts from one to 1024 characters. Both uppercase <strong>and</strong> lowercase characters areallowed. If OMVSPGM isn't entered, USS gives control to the default shellprogram. OMVSPGM is optional.1–8 Cookbook
Change language