eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Tracing UNIX System Services (OMVS)Tracing UNIX System Services (OMVS)The SECTRACE facility, used to trace SAF requests in the eTrust CA-Top Secretenvironment, also is available to trace SAF requests made by OMVS. The onlyallowable value for the DEST= parameter of the TYPE=OMVS SECTRACEcommand is DEST=SYSLOG.To start SECTRACE for OMVS, issue the following command:ST SET,TYPE=OMVS,FUNC=XXXX,DEST=SYSLOG,ENDFUNC ID=xxx can be one of seven values. Each function traces a set of relatedOMVS services.The seven functions and the services that they trace are:FunctionALLCHANGECHECKGETINITMAKEMISCSETServiceTraces all OMVS services.Traces R_chown, R-chaudit, and R_cmod.Traces ck_access, ck_priv, ck_process_owner,ck_file_owner, R_ptrace, ck_IPC_access,ck_owner_two_files, R_IPC_ctl, and R_dceauth.Traces getUMAP, getGMAP, R_getgroups,R_getgroupsbyname, get_uid_gid_supgrps, R_dceinfo,R_dcekey, R_dceuid, and R_usermap.Traces initACEE, initUSP, deleteUSP, and R_fork.Traces makeFSP, makeISP, and make_root_FSP.Traces audit, query_file_security_options, andquery_system_security_options.Traces R_umask, R_setegid, R_seteuid, R_setgid,R_setuid, R_exec, clear_setid, and R_admin.The OMVS services are documented in the IBM OS/390 Security Services CallableServices Guide. You should only use the OMVS SECTRACE when instructed to byeTrust CA-Top Secret Technical Support due to the large volume of trace entriespossible in the OMVS environment. It is usually easier to debug an OMVSproblem using the TSSOERPT report, because it shows more information thanthe trace. All of the OMVS services write SMF records when the service returnswith a non-zero return code.1–20 Cookbook
Tracing UNIX System Services (OMVS)Stopping the SECTRACE for OMVSTo disable the SECTRACE for OMVS, issue the following command, where xxxxis the identifier assigned to the SECTRACE:ST DISABLE,ID=XXXX,ENDYou can restart a disabled trace by entering an enable command. To start adisabled trace, issue the following command, where xxxx is the identifierassigned to the SECTRACE:ST ENABLE,ID=XXXX,ENDTo stop the SECTRACE for OMVS, issue the following command, where xxxx isthe identifier assigned to the SECTRACE:ST DEL,ID=XXXX,ENDUNIX System Services ReportingTSSOERPT UtilityAuthority and ScopeThe batch utility program, TSSOERPT, processes security-related activityrecorded in SMF data sets. To monitor user activity in a UNIX System Servicesenvironment, eTrust CA-Top Secret logs security events under UNIX SystemServices to SMF using the standard eTrust CA-Top Secret SMF record. Logrecords are written for any security event that denies the acid access to a UNIXSystem Services facility. These records can assist you in determining the UID andGID of the acid involved in the attempted access.eTrust CA-Top Secret performs authorization checking to determine whether theperson submitting the TSSOERPT job is authorized to view or manipulate theinput SMF data. You can only extract those incidents that are generated for acidswithin the scope of your authority. The scopes are:■■■■■■SCA—every eventLSCA—every event within the LSCAs scopeZCA—entire zone or specific divisions, departments or acids within the zoneVCA—entire division or specific departments or acids within the divisionDCA—entire department or specific acids within the departmentUSER—himselfImplementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–21
- Page 1 and 2: eTrust CA-Top Secret ® Securityfo
- Page 3: Technical UpdatesMay 2003The follow
- Page 6 and 7: Superuser Granularity .............
- Page 8 and 9: WLM (Workload Management)..........
- Page 11 and 12: Chapter1Implementing eTrust CA-TopS
- Page 13 and 14: z/OS and OS/390 CompatibilityThe li
- Page 15 and 16: z/OS and OS/390 Release-Specific Se
- Page 17 and 18: OpenEdition MVS / UNIX System Servi
- Page 19 and 20: OpenEdition MVS / UNIX System Servi
- Page 21 and 22: OpenEdition MVS / UNIX System Servi
- Page 23 and 24: OpenEdition MVS / UNIX System Servi
- Page 25 and 26: OpenEdition MVS / UNIX System Servi
- Page 27 and 28: OpenEdition MVS / UNIX System Servi
- Page 29: OpenEdition MVS / UNIX System Servi
- Page 33 and 34: Tracing UNIX System Services (OMVS)
- Page 35 and 36: Tracing UNIX System Services (OMVS)
- Page 37 and 38: Tracing UNIX System Services (OMVS)
- Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
- Page 41 and 42: Using TCP/IPwheresysname is the nam
- Page 43 and 44: Using FTPHow to Secure FTPFTP runs
- Page 45 and 46: Using TELNETTerminal Source Restric
- Page 47 and 48: WebSphere Application Server for z/
- Page 49 and 50: WebSphere Application Server for z/
- Page 51 and 52: WebSphere Application Server for z/
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
- Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
- Page 59 and 60: Lotus Domino Go WebserverTo disable
- Page 61 and 62: Lotus Notes and Novell Directory Se
- Page 63 and 64: Digital Certificate SupportGeneral
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
- Page 69 and 70: Digital Certificate SupportNote: In
- Page 71 and 72: Digital Certificate SupportYou can
- Page 73 and 74: Digital Certificate SupportCase #2.
- Page 75 and 76: Digital Certificate SupportImportan
- Page 77 and 78: Digital Certificate SupportAdding a
- Page 79 and 80: Digital Certificate SupportReconnec
Tracing UNIX System Services (OMVS)Tracing UNIX System Services (OMVS)The SECTRACE facility, used to trace SAF requests in the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>environment, also is available to trace SAF requests made by OMVS. The onlyallowable value <strong>for</strong> the DEST= parameter of the TYPE=OMVS SECTRACEcomm<strong>and</strong> is DEST=SYSLOG.To start SECTRACE <strong>for</strong> OMVS, issue the following comm<strong>and</strong>:ST SET,TYPE=OMVS,FUNC=XXXX,DEST=SYSLOG,ENDFUNC ID=xxx can be one of seven values. Each function traces a set of relatedOMVS services.The seven functions <strong>and</strong> the services that they trace are:FunctionALLCHANGECHECKGETINITMAKEMISCSETServiceTraces all OMVS services.Traces R_chown, R-chaudit, <strong>and</strong> R_cmod.Traces ck_access, ck_priv, ck_process_owner,ck_file_owner, R_ptrace, ck_IPC_access,ck_owner_two_files, R_IPC_ctl, <strong>and</strong> R_dceauth.Traces getUMAP, getGMAP, R_getgroups,R_getgroupsbyname, get_uid_gid_supgrps, R_dceinfo,R_dcekey, R_dceuid, <strong>and</strong> R_usermap.Traces initACEE, initUSP, deleteUSP, <strong>and</strong> R_<strong>for</strong>k.Traces makeFSP, makeISP, <strong>and</strong> make_root_FSP.Traces audit, query_file_security_options, <strong>and</strong>query_system_security_options.Traces R_umask, R_setegid, R_seteuid, R_setgid,R_setuid, R_exec, clear_setid, <strong>and</strong> R_admin.The OMVS services are documented in the IBM <strong>OS</strong>/390 <strong>Security</strong> Services CallableServices Guide. You should only use the OMVS SECTRACE when instructed to by<strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> Technical Support due to the large volume of trace entriespossible in the OMVS environment. It is usually easier to debug an OMVSproblem using the TSSOERPT report, because it shows more in<strong>for</strong>mation thanthe trace. All of the OMVS services write SMF records when the service returnswith a non-zero return code.1–20 Cookbook
Change language