eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

OpenEdition MVS / UNIX System Services SupportThe following authorization will limit USER01 to a maximum of 200 openprocesses at the same time.TSS ADD(acid) PROCUSER(200)To remove the above PROCUSER authorization, issue the following command:TSS REMOVE(acid) PROCUSERz/OS and OS/390 ServerPac upgradePrior to restoring the HFS, you must ensure that the proper authority is given tothe user ID that will submit the dialog jobs. This user ID must be a superuser(UID=0). Just having access to the BPX.SUPERUSER facility class is not sufficient.This is because the PAX utility is used to unload the serverpac HFS and thisutility does not yet use the BPX.SUPERUSER facility class to establish superuseridentification.To authorize the acid to run the PAX utility follow these directions:Step 1—Define the acid as a superuser by issuing the following TSS command:TSS ADD(acid) UID(0)ACID SYSPROG1 is defined as a superuser by setting the UID value to zero.Step 2—Define SYSPROG1 as a member of a group by issuing:TSS ADD(acid) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)Step 3—IBMFAC authorizations:TSS PERMIT(acid) IBMFAC(BPX.FILEATTR.APF) ACC(READ)TSS PERMIT(acid) IBMFAC(BPX.FILEATTR.PROGCTL) ACC(READ)orTSS PERMIT(acid) IBMFAC(BPX.FILEATTR.) ACC(READ)Logging UNIX System Services Security CallsAudit capability at the file level exists within the UNIX System Servicesenvironment. To implement audit within UNIX System Services at the file ordirectory level use:CHAUDIT—specify audit options for individual files or directoriesOnce audit is set for a file or directory using the CHAUDIT command, SMFrecords are written for the file or directory designated activity. This can includeaccess, as well as, changes to permission bit settings.The full syntax of the CHAUDIT command is documented in the OS/390 UNIXSystem Services Command Reference Guide.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–19