eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
OpenEdition MVS / UNIX System Services SupportHow to Refresh UID and GID TableseTrust CA-Top Secret maintains in-storage tables of UIDs and GIDs and theirrelated acids. These tables are built during the initial startup of eTrust CA-TopSecret. These tables must be refreshed after a UID or GID is ADDed orREMOVEd from an acid. The following command will refresh these tables.TSS MODIFY(OMVSTABS)How to List All UIDs and GIDsA list of all UIDs and GIDs can be obtained by executing the followingcommands:TSS WHOOWNS UID(*)TSS WHOOWNS GID(*)How to List Who Has UID(0)A list of all users with UID(0) can also be obtained by executing the followingcommand:TSS WHOHAS UID(0)FACILITY Class Resources (IBMFAC)See the UNIX Systems Services Planning Guide for more details of the BPX facilityresources classes.BPX.SUPERUSER—Allows non-superusers to gain superuser authority.(Control over UNIX command su). BPX.SUPERUSER ownership needs to beestablished in the following fashion:TSS ADD(dept) IBMFAC(BPX.)TSS permit commands can then be used to grant access to specific resourceslisted below.TSS PER(acid) IBMFAC(BPX.SMF)BPX.DAEMON—Allows daemon programs to validate user password and thenchange identity of a spawned address space (control over setuid () and seteuid () ).BPX.SERVER—Allows daemon programs to customize the securityenvironment of a thread.BPX.SMF—To restrict access for C/C++ applications to generate SMF recordswithout requiring APF authorization.BPX.DEBUG—To allow users to use dbx to debug programs that run asAPF-authorized or with BPX.SERVER authority.BPX.WLMSERVER—To allow users to use WLM server functions.1–12 Cookbook
OpenEdition MVS / UNIX System Services SupportBPX.STOR.SWAP—To allow users to make address spaces nonswappable.BPX.FILEATTR.APF—To allow users to turn on the APF-authorized attribute foran HFS file.BPX.FILEATTR.PROGCTL—To allow users to turn on the program controlledattribute for an HFS file.TSS PER(acid) IBMFAC(BPX.SMF) ACC(READ)Password Assignment for UID(0) AcidsA potential security concern exists for all acids defined with NOPW and UID(0).In certain scenarios, unauthorized access can occur with these acids using Telnetor Rlogin. To eliminate this potential security concern, you should addpasswords to all UID(0) assigned acids.TSS REPL(acid) PASS(xxxx,0)Several of the created started task acid definitions described in this documentspecify a password. Started task acids with passwords will cause a passwordprompt at the console on startup. This prompting is optional and can be turnedoff using the following methods:■■Control option setting OPTIONS(4) eliminates the console password promptat startup for the password protected STC acids.The OPTIONS control option must be set via the eTrust CA-Top Secretparameter file. It can not be set with a MODIFY command.ACIDs Needed to Install UNIX System ServicesDuring the installation of UNIX System Services, you must create an acid for theOMVS started task and define the installer’s acid (typically a SYSPROG) as asuperuser via a UID(0).Defining the OMVS Started Task ACIDsUNIX System Services must be assigned an acid before you can begin usingeTrust CA-Top Secret in this environment. Follow the steps below to create theOMVS started task acid.Step 1—Create the GROUP acids to which the started task acid are attached byissuing the following TSS commands:TSS CREATE(OMVSGRP) TYPE(GROUP) NAME('OMVS GROUP') DEPT(OMVSDEPT)TSS CREATE(TTY) TYPE(GROUP) NAME('REQ OMVS TTY GROUP') DEPT(OMVSDEPT)USS requires that a group name "TTY" must also exist, and it must be connectedto the OMVS started task acid. See the UNIX System Services Planning Guide foran explanation of TTY.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–13
- Page 1 and 2: eTrust CA-Top Secret ® Securityfo
- Page 3: Technical UpdatesMay 2003The follow
- Page 6 and 7: Superuser Granularity .............
- Page 8 and 9: WLM (Workload Management)..........
- Page 11 and 12: Chapter1Implementing eTrust CA-TopS
- Page 13 and 14: z/OS and OS/390 CompatibilityThe li
- Page 15 and 16: z/OS and OS/390 Release-Specific Se
- Page 17 and 18: OpenEdition MVS / UNIX System Servi
- Page 19 and 20: OpenEdition MVS / UNIX System Servi
- Page 21: OpenEdition MVS / UNIX System Servi
- Page 25 and 26: OpenEdition MVS / UNIX System Servi
- Page 27 and 28: OpenEdition MVS / UNIX System Servi
- Page 29 and 30: OpenEdition MVS / UNIX System Servi
- Page 31 and 32: Tracing UNIX System Services (OMVS)
- Page 33 and 34: Tracing UNIX System Services (OMVS)
- Page 35 and 36: Tracing UNIX System Services (OMVS)
- Page 37 and 38: Tracing UNIX System Services (OMVS)
- Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
- Page 41 and 42: Using TCP/IPwheresysname is the nam
- Page 43 and 44: Using FTPHow to Secure FTPFTP runs
- Page 45 and 46: Using TELNETTerminal Source Restric
- Page 47 and 48: WebSphere Application Server for z/
- Page 49 and 50: WebSphere Application Server for z/
- Page 51 and 52: WebSphere Application Server for z/
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
- Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
- Page 59 and 60: Lotus Domino Go WebserverTo disable
- Page 61 and 62: Lotus Notes and Novell Directory Se
- Page 63 and 64: Digital Certificate SupportGeneral
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
- Page 69 and 70: Digital Certificate SupportNote: In
- Page 71 and 72: Digital Certificate SupportYou can
OpenEdition MVS / UNIX System Services SupportHow to Refresh UID <strong>and</strong> GID Tables<strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> maintains in-storage tables of UIDs <strong>and</strong> GIDs <strong>and</strong> theirrelated acids. These tables are built during the initial startup of <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong><strong>Secret</strong>. These tables must be refreshed after a UID or GID is ADDed orREMOVEd from an acid. The following comm<strong>and</strong> will refresh these tables.TSS MODIFY(OMVSTABS)How to List All UIDs <strong>and</strong> GIDsA list of all UIDs <strong>and</strong> GIDs can be obtained by executing the followingcomm<strong>and</strong>s:TSS WHOOWNS UID(*)TSS WHOOWNS GID(*)How to List Who Has UID(0)A list of all users with UID(0) can also be obtained by executing the followingcomm<strong>and</strong>:TSS WHOHAS UID(0)FACILITY Class Resources (IBMFAC)See the UNIX Systems Services Planning Guide <strong>for</strong> more details of the BPX facilityresources classes.BPX.SUPERUSER—Allows non-superusers to gain superuser authority.(Control over UNIX comm<strong>and</strong> su). BPX.SUPERUSER ownership needs to beestablished in the following fashion:TSS ADD(dept) IBMFAC(BPX.)TSS permit comm<strong>and</strong>s can then be used to grant access to specific resourceslisted below.TSS PER(acid) IBMFAC(BPX.SMF)BPX.DAEMON—Allows daemon programs to validate user password <strong>and</strong> thenchange identity of a spawned address space (control over setuid () <strong>and</strong> seteuid () ).BPX.SERVER—Allows daemon programs to customize the securityenvironment of a thread.BPX.SMF—To restrict access <strong>for</strong> C/C++ applications to generate SMF recordswithout requiring APF authorization.BPX.DEBUG—To allow users to use dbx to debug programs that run asAPF-authorized or with BPX.SERVER authority.BPX.WLMSERVER—To allow users to use WLM server functions.1–12 Cookbook
Change language