eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Using FTPIP Address ProtectionSecuring an IP address using eTrust CA-Top Secret (or any external securityproduct) requires that the TCP/IP product installed pass the IP address packet.Not all TCP/IP vendor products pass this information. IBM’s TCP/IP productdoes pass the IP address.IP address protection is not available if your TCP/IP product does not pass theIP address packet.The IP packet passed is generated from the user's originating IP address. Thus,these IP packets often have no resemblance to standard LU names. Each node ofthe IP address is translated into a character representation of the hex value of thenode. For example, the IP address 141.202.201.56 would appear as terminal8DCAC938. The hex value of 141 is 8D, the hex value of 202 is CA, and so on.eTrust CA-Top Secret allows you two mechanisms to implement security of an IPaddress. Dotted IP is converted to hex pairs. If you want to restrict a particularuser to enter the system only through a given IP address, you would use sourcerestriction. For example:TSS ADD(aicd) SOURCE(8DCAC938) equivalent to 141.202.201.56If you want to protect an IP address or range from use, you would useTERMINAL restriction. For example, to restrict use of all IP addresses starting141.202 for all users:TSS ADD(dept) TERMINAL(8DCA)To permit userid2 to use IP addresses starting 141.202:TSS PERMIT(userid2) TERMINAL(8DCA)To permit userid3 to use IP addresses starting 141.202.201:TSS PERMIT(userid3) TERMINAL(8DCAC9)Using FTPFTP is a feature of TCP/IP that allows users to transfer files to and from themainframe. In addition, remote users can submit jobs to MVS. Users are requiredto identify themselves when using FTP.FTP runs as an MVS or UNIX System Services application. Security configurationis similar for both.1–32 Cookbook

Using FTPHow to Secure FTPFTP runs as its own started task which needs to be associated with a Region acid,and the TCP/IP facility. The command used to create this acid should look likethe one shown in the following.TSS CRE(FTP) NAME('FTP SERVER ACID')FAC(BATCH,STC) PASS(password,0)DEPT(DEPT) MASTFAC(TCP)NOVOLCHK NODSNCHK NOLCFCHK NORESCHK NOSUBCHKNote: The use of the bypass attributes such as NODSNCHK and NOSUBCHK,are entered for simplicity. You can choose to omit them and explicitly permit theacid to all resources it will access.Define the FTP procedure to the eTrust CA-Top Secret STC record with thefollowing command:TSS ADD(STC) PROCNAME(FTPSERVE) ACID(FTP)How to Secure FTP for UNIX System ServicesPackaged with TCP/IP OE Application Services, OE/FTP is an OMVSapplication that executes under UNIX System Services to facilitate the filetransfer of HFS files throughout a TCP/IP network.OE/FTP is different than the more common mainframe FTP product. OE/FTPtypically executes under a started-task named FTPD whereas FTP typicallyexecutes under a started-task named FTPSERVE.To complement OE/FTP, the above package includes an optional message-logdaemon (called Syslog-D) which can be used to log both past and presentmessage traffic related to OE/FTP. This optional logging task should beconsidered because, without it, there is no ongoing log of OE/FTP activity.The following steps replace the IBM requirements when installing OE/FTP witheTrust CA-Top Secret.1. The O/E FTP started task (daemon) typically runs under a userid of FTPD.The exception occurs when the task is automatically started by OMVS, inwhich case it inherits the identity of the OMVS kernel, typically OMVS orOMVSKERN.If running as an FTPD, the following example shows the administrationneeded to properly define the acid.TSS CRE(FTPD) TYPE(USER) NAME('OE/FTP STC ID') DEPT(anydept)FAC(STC) PASSWORD(password,0) MASTFAC(TCP)TSS ADD(FTPD) UID(0) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)TSS ADD(STC) PROCname(FTPD) ACID(FTPD)If running under the OMVS kernel ID, no additional setup is necessary.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–33

Using FTPHow to Secure FTPFTP runs as its own started task which needs to be associated with a Region acid,<strong>and</strong> the TCP/IP facility. The comm<strong>and</strong> used to create this acid should look likethe one shown in the following.TSS CRE(FTP) NAME('FTP SERVER ACID')FAC(BATCH,STC) PASS(password,0)DEPT(DEPT) MASTFAC(TCP)NOVOLCHK NODSNCHK NOLCFCHK NORESCHK N<strong>OS</strong>UBCHKNote: The use of the bypass attributes such as NODSNCHK <strong>and</strong> N<strong>OS</strong>UBCHK,are entered <strong>for</strong> simplicity. You can choose to omit them <strong>and</strong> explicitly permit theacid to all resources it will access.Define the FTP procedure to the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> STC record with thefollowing comm<strong>and</strong>:TSS ADD(STC) PROCNAME(FTPSERVE) ACID(FTP)How to Secure FTP <strong>for</strong> UNIX System ServicesPackaged with TCP/IP OE Application Services, OE/FTP is an OMVSapplication that executes under UNIX System Services to facilitate the filetransfer of HFS files throughout a TCP/IP network.OE/FTP is different than the more common mainframe FTP product. OE/FTPtypically executes under a started-task named FTPD whereas FTP typicallyexecutes under a started-task named FTPSERVE.To complement OE/FTP, the above package includes an optional message-logdaemon (called Syslog-D) which can be used to log both past <strong>and</strong> presentmessage traffic related to OE/FTP. This optional logging task should beconsidered because, without it, there is no ongoing log of OE/FTP activity.The following steps replace the IBM requirements when installing OE/FTP with<strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>.1. The O/E FTP started task (daemon) typically runs under a userid of FTPD.The exception occurs when the task is automatically started by OMVS, inwhich case it inherits the identity of the OMVS kernel, typically OMVS orOMVSKERN.If running as an FTPD, the following example shows the administrationneeded to properly define the acid.TSS CRE(FTPD) TYPE(USER) NAME('OE/FTP STC ID') DEPT(anydept)FAC(STC) PASSWORD(password,0) MASTFAC(TCP)TSS ADD(FTPD) UID(0) GROUP(OMVSGRP) DFLTGRP(OMVSGRP)TSS ADD(STC) PROCname(FTPD) ACID(FTPD)If running under the OMVS kernel ID, no additional setup is necessary.Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–33

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!