eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Using TELNETTerminal Source RestrictionFTP logons specify a terminal ID when logging on a user. This terminal IDsupplied is generated from the user's originating IP address. Thus, these terminalIDs often have no resemblance to standard LU names. Each node of the IPaddress is translated into a character representation of the hex value of the node.For example, the IP address 141.202.201.56 would appear as terminal 8DCAC938.The hex value of 141 is 8D, the hex value of 202 is CA, etc. To administer sourceprotection in eTrust CA-Top Secret, issue the following:TSS ADD(acid) SOURCE(8DCAC938)Using TELNETTELNET is a feature of TCP/IP, which allows users terminal access to a systemover a TCP/IP network. TELNET runs under both native MVS and UNIX SystemServices.If running under native MVS, users can be forced to log on to TELNET itself.This will occur if the TELNET configuration statements, in the TCP/IP profiledata set, do not specify a DFLTAPPL. If configured this way, users logging on toTELNET will require the TCP/IP facility. Alternatively, DFLTAPPL can bespecified, which directs all logons to a session manager such as Unicenter ®CA-TPX. The session manager then controls access through its securityinterface.How to Secure TELNET for UNIX System ServicesWhen using TELNET under OMVS, RLOGIN runs under its own acid until theuser successfully signs on. The ID of this acid is specified in the configuration fileetc/inetd/conf. It is delivered specifying an ID of OMVSKERN and must bedefined with both superuser and daemon authority.The following commands would define such an acid.TSS CRE(OMVSKERN) TYPE(USER)NAME('OMVS ACID') PASS(password,0)DEPT(dept)TSS ADD(OMVSKERN) UID(0) GROUP(OMVSGRP)DFLTGRP(OMVSGRP) HOME(/)OMVSPGM(/bin/sh)If you are using OMVSKERN, it is likely that this ID was defined as part of yourOMVS installation.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–35