eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

OpenEdition MVS / UNIX System Services SupportThe following example shows how to define user OMVSUSR as a superuser.Since HOME and OMVSPGM aren't explicitly specified, the defaults are takenfor these fields.TSS ADD(OMVSUSR) UID(0)This example shows how to define user OMVSU2 as a regular user. The HOMEand PROGRAM keywords are also used.TSS ADD(OMVSU2) UID(199) HOME(/u/omvsu2) OMVSPGM(/bin/sh)SUPERUSER—A superuser passes all UNIX System Services security checksand, therefore, can access all UNIX files. An acid can become a superuser in oneof two ways:■or■Have a UID(0)Use the SU (switch user) command if resource IBMFAC(BPX.SUPERUSER)has been permitted to that user.Other than the required started task acids, the only acids requiring a UID(0) arethe system programmers responsible for installing USS. All other acids shouldhave a non-zero UID and be permitted the necessary authorities in the classIBMFAC plus file permissions. The eTrust CA-Top Secret resource class IBMFACis equivalent to the IBM FACILITY class.How to Define UNIX System Services GroupsUNIX System Services security is based on user and group ownership of filesand processes. eTrust CA-Top Secret uses the DFLTGRP and GROUP fields ofthe acid record to assign the user to a UNIX System Services group.eTrust CA-Top Secret requires that the UID be unique for each acid (except UID0) and that the GID is unique for each group acid. (Only UID 0 can be assigned tomore than one acid.)The GROUP type acid defines UNIX System Services groups to eTrust CA-TopSecret. The GROUP type acid contains the OMVS segment, which consists of onefield: the GID keyword.GID is a numeric field that accepts values from zero to 2,147,483,647. This valuemust be unique to maintain control over a particular group. You can assign up to256 groups to a user, using the GROUP field.The following example shows how to create an OMVS GROUP acid for a groupcalled OMVSGRP and assign it a GID of 1.TSS CREATE(OMVSGRP) TYPE(GROUP) NAME(‘OMVSGROUP’) DEPT(OMVSDEPT)TSS ADD(OMVSGRP) GID(1)At least one OMVS group acid must exist prior to implementation.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–9