eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Using TCP/IPSet all other FACILITY parameters according to your site-specific needs.Note: If the RES attribute is omitted from the FACILITY definition, no user orprofile data set rules are loaded into the TCP address space.Step 2—Create a Region acid.The command used to create this acid should look like the example shown in thefollowing.TSS CRE(TCP) NAME('TCPIP/FTP REGION ACID') FAC(BATCH,STC)PASS(password,0) DEPT(DEPT) MASTFAC(TCP)NOVOLCHK NODSNCHK NOLCFCHK NORESCHK NOSUBCHKTSS ADD(TCP) UID(0) GROUP(OMVSGRP)DFLTGRP(OMVSGRP) HOME(/)OMVSGPGM (/bin/sh)The Region acid must have:■■The NODSNCHK attribute or a permit for DSN(*****) ACC(ALL).The NOSUBCHK attribute. If this attribute is omitted, DRC157 errors onsubmit of batch jobs from the TCP address space will occur.To properly secure job submission, the JES facility must be in FAIL MODE.Step 3—Define the TCP procedure to the eTrust CA-Top Secret STC Record.TSS ADD(STC) PROCNAME(TCPPROC) ACID(TCP)TCP/IP SERVAUTH ClassTCP/IP in OS/390 2.10 uses the SERVAUTH resource class to protect TCP/IPresources from unauthorized access. There are four functions protected by theSERVAUTH class. They are:Stack Access—Controls which users can get access to the TCP/IP stack.Resource name: EZB.STACKACCESS.sysname.tcpipidNet Access—Controls which users can access individual networks.Resource name: EZB.NETACCESS.sysname.tcpipid.netnamePort Access—Controls which users can use TCP and UDP ports.Resource name: EZB.PORTACCESS.sysname.tcpipid.portnameTN3270 controls which users can use the secured ports.Resource name: EZB.TN3270.sysname.tcpipid.PORTnnnn1–30 Cookbook