eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

OpenEdition MVS / UNIX System Services SupportTo create a Superuser Administrator acid and give it the authority it needs,follow these directions:Step 1—Define the acid as a superuser by issuing the following TSS command:TSS ADD(acid) UID(0)ACID SYSPROG1 is defined as a superuser by setting the UID value to zero.Step 2—Define SYSPROG1 as a member of a group by issuing:TSS ADD(acid) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)The example shows ACID SYSPROG1 changed so that this user can sign on andbe validated as a member of group OMVSGRP. The acids of group OMVSGRPare a special subset of users who perform system-related tasks.Superuser GranularitySuperuser Granularity support lets you avoid giving users superuser authorityvia UID(0). This is accomplished by allowing non-superuser users to have accessto new resources in the UNIXPRIV class. At OS/390 V2R8 and above, if a userdoesn't have a UID=0, but they do have access to one of the new resources,access is allowed. The following table defines the new resources and what accessis allowed by the resource.eTrust CA-Top Secret SAF HFS security provides much greater superusergranularity than this method. See Chapter 2 of this guide for details onimplementing eTrust CA-Top Secret's SAF HFS security. Activating eTrustCA-Top Secret SAF HFS security will override the superuser granularitysupport described in this section if there is an equivalent SAF HFS securityresource for the UNIXPRIV resource. If there is no SAF HFS resource, theUNIXPRIV resource is checked instead.Resource Name Access Given Functions AffectedSUPERUSER.FILESYS.FILE (READaccess or higher)SUPERUSER.FILESYS.FILE(UPDATE access or higher)SUPERUSER.FILESYS.FILE(CONTROL Access)SUPERUSER.FILESYS.CHOWNAllows a user to read any HFSfile and read or search anyHFS directoryAllows a user to write to anyexisting HFS file.Allows a user to write to anyHFS directory.Allows a user to changeownership of any file.Open*( for read, opendir(),readlink(), stat(), realpath(0)Open() for writeLink(), mkdir(), rename(),mdir(), syslink(), unlink().Chown()1–16 Cookbook

OpenEdition MVS / UNIX System Services SupportResource Name Access Given Functions AffectedSUPERUSER.FILESYS.MOUNTAllows a user to issue mount,unmount, quiesce, andunquiesce requests. changeownership of any file.SUPERUSER.FILESYS.PFSCTL Allows a user to call pfsctl() Pfsctl()SUPERUSER.FILESYS.VREGISTERSUPERUSER.IPC.RMIDSUPERUSER.PROCESS.GETPSENTSUPERUSER.PROCESS.KILLSUPERUSER.PROCESS.PTRACESUPERUSER.SETPRIORITYAllows a user to issuevregister() to register as a vfsfile serverAllows a user to do ipcrm callsto clean up leftover IPCmechanismsAllows users to see allprocessesAllows user to send signals toany processAllows users to use dbx totrace any processAllows a user to increase hispriority.Mount(), unmount(), quiesce(),unquiesce()Vregister()Ipcrm command user ofIPC_RMID for msgct(),semctl(), shmctl()Getpsent()—ps commandKill()DbxSetpriority(), nice()Superuser Granularity examples:Before you can give a user access to a SUPERUSER resource in the UNIXPRIVclass, you must perform the following ADD command:TSS ADD(dept) UNIXPRIV(SUPERUSE)The following permission gives USER01 authority to read to any HFS file.TSS PERMIT(acid) UNIXPRIV(SUPERUSER.FILESYS.FILE) ACCESS(READ)The following permission gives USER01 authority to change ownership of a file.TSS PERMIT(acid) UNIXPRIV(SUPERUSER.FILESYS.CHOWN) ACCESS(READ)Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–17

OpenEdition MVS / UNIX System Services SupportResource Name Access Given Functions AffectedSUPERUSER.FILESYS.MOUNTAllows a user to issue mount,unmount, quiesce, <strong>and</strong>unquiesce requests. changeownership of any file.SUPERUSER.FILESYS.PFSCTL Allows a user to call pfsctl() Pfsctl()SUPERUSER.FILESYS.VREGISTERSUPERUSER.IPC.RMIDSUPERUSER.PROCESS.GETPSENTSUPERUSER.PROCESS.KILLSUPERUSER.PROCESS.PTRACESUPERUSER.SETPRIORITYAllows a user to issuevregister() to register as a vfsfile serverAllows a user to do ipcrm callsto clean up leftover IPCmechanismsAllows users to see allprocessesAllows user to send signals toany processAllows users to use dbx totrace any processAllows a user to increase hispriority.Mount(), unmount(), quiesce(),unquiesce()Vregister()Ipcrm comm<strong>and</strong> user ofIPC_RMID <strong>for</strong> msgct(),semctl(), shmctl()Getpsent()—ps comm<strong>and</strong>Kill()DbxSetpriority(), nice()Superuser Granularity examples:Be<strong>for</strong>e you can give a user access to a SUPERUSER resource in the UNIXPRIVclass, you must per<strong>for</strong>m the following ADD comm<strong>and</strong>:TSS ADD(dept) UNIXPRIV(SUPERUSE)The following permission gives USER01 authority to read to any HFS file.TSS PERMIT(acid) UNIXPRIV(SUPERUSER.FILESYS.FILE) ACCESS(READ)The following permission gives USER01 authority to change ownership of a file.TSS PERMIT(acid) UNIXPRIV(SUPERUSER.FILESYS.CHOWN) ACCESS(READ)Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–17

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!