eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Using FTP2. The FTP server acid requires the ability to perform work on behalf of userslogging on to FTP, and at times switch its identity to that of a user.Accordingly, it requires superuser authority. This can be done as shownabove, by adding UID(0) to the acid. Alternatively, you can give the acid anon-zero UID and permit it access to Superuser authority as follows:TSS PERMIT(FTPD) IBMFAC(BPX.SUPERUSER) ACCESS(READ)IBM recommends that you increase your level of security by protectingdaemon authority. This is accomplished in eTrust CA-Top Secret by owningthe resource IBMFAC(BPX.DAEM). Once this is done, you must explicitlypermit daemon authority to the server, even if it is running under UID(0), byentering the following command:TSS PERMIT(FTPD) IBMFAC(BPX.DAEMON) ACCESS(READ)3. The TSS Facility named "TCP" is used to control which end users are able toaccess OE/FTP. Access to the "TCP" Facility must be given to user acids thataccess OE/FTP.Considerations for Securing FTPUsers accessing FTP must log on to the service before using it. This requires themto supply their userids and passwords and for their userids to have access to theTCPIP facility. FTP also supports anonymous logons.In the FTPDATA configuration file, the parameter ANONYMOUS controlswhether this feature can be used. The parameter can be specified in one of threeways:ANONYMOUSANONYMOUS useridANONYMOUS userid/passwordIf the parameter is specified without a following userid, and an FTP userspecifies anonymous at logon time, RACINIT are issued for the acidANONYMOU. If this acid is defined to eTrust CA-Top Secret and has access tothe TCP/IP facility, the user is allowed to log on and run under the authority ofthe "ANONYMOU" acid.If the parameter is specified with a following userid, the user must provide thecorrect password for this userid. If the parameter is specified with both USERIDand PASSWORD, these values are used to sign on the user.The use of ANONYMOUS logon should be carefully considered, and if used, canbe a candidate for auditing.1–34 Cookbook