eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

OpenEdition MVS / UNIX System Services SupportBPX.STOR.SWAP—To allow users to make address spaces nonswappable.BPX.FILEATTR.APF—To allow users to turn on the APF-authorized attribute foran HFS file.BPX.FILEATTR.PROGCTL—To allow users to turn on the program controlledattribute for an HFS file.TSS PER(acid) IBMFAC(BPX.SMF) ACC(READ)Password Assignment for UID(0) AcidsA potential security concern exists for all acids defined with NOPW and UID(0).In certain scenarios, unauthorized access can occur with these acids using Telnetor Rlogin. To eliminate this potential security concern, you should addpasswords to all UID(0) assigned acids.TSS REPL(acid) PASS(xxxx,0)Several of the created started task acid definitions described in this documentspecify a password. Started task acids with passwords will cause a passwordprompt at the console on startup. This prompting is optional and can be turnedoff using the following methods:■■Control option setting OPTIONS(4) eliminates the console password promptat startup for the password protected STC acids.The OPTIONS control option must be set via the eTrust CA-Top Secretparameter file. It can not be set with a MODIFY command.ACIDs Needed to Install UNIX System ServicesDuring the installation of UNIX System Services, you must create an acid for theOMVS started task and define the installer’s acid (typically a SYSPROG) as asuperuser via a UID(0).Defining the OMVS Started Task ACIDsUNIX System Services must be assigned an acid before you can begin usingeTrust CA-Top Secret in this environment. Follow the steps below to create theOMVS started task acid.Step 1—Create the GROUP acids to which the started task acid are attached byissuing the following TSS commands:TSS CREATE(OMVSGRP) TYPE(GROUP) NAME('OMVS GROUP') DEPT(OMVSDEPT)TSS CREATE(TTY) TYPE(GROUP) NAME('REQ OMVS TTY GROUP') DEPT(OMVSDEPT)USS requires that a group name "TTY" must also exist, and it must be connectedto the OMVS started task acid. See the UNIX System Services Planning Guide foran explanation of TTY.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–13