eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

More documents

Recommendations

Info

WebSphere Application Server for z/OS AND OS/390/* =============================================================== *//* CONNECTING IVP CR AND SR USERIDS TO THE CB CONFIGURATION GROUP. *//* =============================================================== */TSS ADDTO(CBACRU1) GROUP(CBCFG1)TSS ADDTO(CBASRU1) GROUP(CBCFG1)TSS ADDTO(CBACRU2) GROUP(CBCFG1)TSS ADDTO(CBASRU2) GROUP(CBCFG1)/* =============================================================== *//* CONNECTING STC ACIDS TO THE CB PROFILES *//* =============================================================== */TSS ADDTO(CBDMNCR1) PROF(CBCTL1P)TSS ADDTO(CBNAMCR1) PROF(CBCTL1P)TSS ADDTO(CBNAMSR1) PROF(CBSR1P)TSS ADDTO(CBSYMCR1) PROF(CBCTL1P)TSS ADDTO(CBSYMSR1) PROF(CBSR1P)TSS ADDTO(CBINTCR1) PROF(CBCTL1P)TSS ADDTO(CBINTSR1) PROF(CBSR1P)TSS ADDTO(CBACRU1) PROF(CBCTL1P)TSS ADDTO(CBASRU1) PROF(CBASR1P)TSS ADDTO(CBACRU2) PROF(CBCTL1P)TSS ADDTO(CBASRU2) PROF(CBASR2P)/* =============================================================== */TSS ADDTO(WASDEPT) LOGSTRM(DEFAULT_LOGSTREAM_NAME)TSS PERMIT(ALL) LOGSTRM(DEFAULT_LOGSTREAM_NAME) ACCESS(READ)TSS PERMIT(CBCTL1P) LOGSTRM(DEFAULT_LOGSTREAM_NAME) ACCESS(UPDATE)TSS PERMIT(CBSR1P) LOGSTRM(DEFAULT_LOGSTREAM_NAME) ACCESS(UPDATE)TSS PERMIT(CBASR1P) LOGSTRM(DEFAULT_LOGSTREAM_NAME) ACCESS(UPDATE)TSS PERMIT(CBASR2P) LOGSTRM(DEFAULT_LOGSTREAM_NAME) ACCESS(UPDATE)/* =============================================================== *//* DEFINE CBIND(CB.) *//* =============================================================== */TSS ADDTO(WASDEPT) CBIND(CB.)/* =============================================================== *//* DEFINING CBIND CB.BIND.GENERIC_SERVER. *//* =============================================================== */TSS PERMIT(CBCTL1P) CBIND(CB.BIND.CBDAEMON) ACCESS(CONTROL)TSS PERMIT(CBCTL1P) CBIND(CB.BIND.CBNAMING) ACCESS(CONTROL)TSS PERMIT(CBCTL1P) CBIND(CB.BIND.CBSYSMGT) ACCESS(CONTROL)TSS PERMIT(CBCTL1P) CBIND(CB.BIND.CBINTFRP) ACCESS(CONTROL)TSS PERMIT(CBCTL1P) CBIND(CB.BIND.BBOASR1) ACCESS(CONTROL)TSS PERMIT(CBCTL1P) CBIND(CB.BIND.BBOASR2) ACCESS(CONTROL)/* =============================================================== *//* DEFINING CBIND CB.GENERIC_SERVER. *//* =============================================================== */TSS PERMIT(ALL) CBIND(CB.) ACCESS(NONE)/* =============================================================== *//* DEFINING CBIND CB.GENERIC_SERVER ACCESS FOR CB SYSTEMS SERVERS *//* =============================================================== */TSS PERMIT(ALL) CBIND(CB.CBDAEMON) ACCESS(READ)TSS PERMIT(ALL) CBIND(CB.CBNAMING) ACCESS(READ)TSS PERMIT(ALL) CBIND(CB.CBSYSMGT) ACCESS(READ)TSS PERMIT(ALL) CBIND(CB.CBINTFRP) ACCESS(READ)/* =============================================================== *//* DEFINING CBIND CB.GENERIC_SERVER FOR IVP1 SERVERS AS UACC(READ) *//* =============================================================== */TSS PERMIT(ALL) CBIND(CB.BBOASR1) ACCESS(READ)/* =============================================================== *//* DEFINING CBIND CB.GENERIC_SERVER FOR IVP2 SERVERS AS UACC(READ) *//* =============================================================== */TSS PERMIT(ALL) CBIND(CB.BBOASR2) ACCESS(READ)/* =============================================================== *//* DEFINING SERVER CB.SERVER_INSTANCE.GENERIC_SERVER. *//* =============================================================== */TSS ADDTO(WASDEPT) SERVER(CB.)TSS PERMIT(ALL) SERVER(CB.) ACCESS(NONE)/* =============================================================== */1–46 Cookbook
Lotus Domino Go Webserver/* PERMITTING SERVER CLASS ACCESS. *//* =============================================================== */TSS PERMIT(CBNAMSR1) SERVER(CB.*.CBNAMING) ACCESS(READ)TSS PERMIT(CBSYMSR1) SERVER(CB.*.CBSYSMGT) ACCESS(READ)TSS PERMIT(CBINTSR1) SERVER(CB.*.CBINTFRP) ACCESS(READ)TSS PERMIT(CBASRU1) SERVER(CB.*.BBOASR1) ACCESS(READ)TSS PERMIT(CBASRU2) SERVER(CB.*.BBOASR2) ACCESS(READ)/* =============================================================== *//* ASSIGNING USERIDS TO STARTED TASKS. *//* =============================================================== */TSS ADDTO(STC) PROCNAME(BBODMN) ACID(CBDMNCR1)TSS ADDTO(STC) PROCNAME(BBONM) ACID(CBNAMCR1)TSS ADDTO(STC) PROCNAME(BBONMS) ACID(CBNAMSR1)TSS ADDTO(STC) PROCNAME(BBOSMS) ACID(CBSYMCR1)TSS ADDTO(STC) PROCNAME(BBOSMSS) ACID(CBSYMSR1)TSS ADDTO(STC) PROCNAME(BBOIR) ACID(CBINTCR1)TSS ADDTO(STC) PROCNAME(BBOIRS) ACID(CBINTSR1)TSS ADDTO(STC) PROCNAME(BBOWTR) ACID(STCRACF)TSS ADDTO(STC) PROCNAME(BBOASR1) ACID(CBACRU1)TSS ADDTO(STC) PROCNAME(BBOASR1S) ACID(CBASRU1)TSS ADDTO(STC) PROCNAME(BBOASR2) ACID(CBACRU2)TSS ADDTO(STC) PROCNAME(BBOASR2S) ACID(CBASRU2)/* =============================================================== *//* SETTING UP THE PASSTICKET. *//* =============================================================== */TSS ADDTO(NDT) PSTKAPPL(CBS390) SESSKEY(0123456789ABCDEF)/* =============================================================== */EXITSecurity AuditingSecurity auditing is handled in the usual way by the security product.WebSphere for z/OS uses the System Authorization Facility (SAF), whichprovides an auditing mechanism consistent with other functions in z/OS orOS/390.Lotus Domino Go WebserverThe Lotus Domino Go Webserver is an IBM offering that allows the MVSmainframe to act as an Internet web server. This offering is installed andmanaged as an UNIX System Services application. By default, the Domino GoWebserver materials are installed within the OMVS environment in a directorynamed /usr/lpp/internet.As documented by IBM, installation of the Domino Go Webserver includesseveral steps using the RACF security administrator. Listed below are thedeviations and equivalent commands needed when installing this offering andusing eTrust CA-Top Secret.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–47
Page 1 and 2:
eTrust CA-Top Secret ® Securityfo
Page 3:
Technical UpdatesMay 2003The follow
Page 6 and 7: Superuser Granularity .............
Page 8 and 9: WLM (Workload Management)..........
Page 11 and 12: Chapter1Implementing eTrust CA-TopS
Page 13 and 14: z/OS and OS/390 CompatibilityThe li
Page 15 and 16: z/OS and OS/390 Release-Specific Se
Page 17 and 18: OpenEdition MVS / UNIX System Servi
Page 31 and 32: Tracing UNIX System Services (OMVS)
Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
Page 41 and 42: Using TCP/IPwheresysname is the nam
Page 43 and 44: Using FTPHow to Secure FTPFTP runs
Page 45 and 46: Using TELNETTerminal Source Restric
Page 47 and 48: WebSphere Application Server for z/
Page 55: WebSphere Application Server for z/
Page 59 and 60: Lotus Domino Go WebserverTo disable
Page 61 and 62: Lotus Notes and Novell Directory Se
Page 63 and 64: Digital Certificate SupportGeneral
Page 65 and 66: Digital Certificate SupportFOR|UNTI
Page 67 and 68: Digital Certificate SupportDCDSN(re
Page 69 and 70: Digital Certificate SupportNote: In
Page 71 and 72: Digital Certificate SupportYou can
Page 73 and 74: Digital Certificate SupportCase #2.
Page 75 and 76: Digital Certificate SupportImportan
Page 77 and 78: Digital Certificate SupportAdding a
Page 79 and 80: Digital Certificate SupportReconnec
Page 81 and 82: Digital Certificate SupportTSS LIST
Page 83 and 84: Certificate Name Filtering SupportT
Page 85 and 86: Certificate Name Filtering SupportI
Page 87 and 88: Certificate Name Filtering SupportD
Page 89 and 90: Certificate Name Filtering SupportL
Page 91 and 92: KerberosKerberosetrust CA-Top Secre
Page 93 and 94: KerberosThe command syntax for this
Page 95 and 96: KerberosThe following command creat
Page 97 and 98: Mapping of Foreign EnvironmentsMapp
Page 99 and 100: Mapping of Foreign EnvironmentsMapp
Page 101 and 102: Distributed File Server SMB SUPPORT
Page 103 and 104: NFS (Network File System)The first
Page 105 and 106: z/OS and OS/390 Security Server Sup
Page 107 and 108:
z/OS and OS/390 Security Server Sup
Page 109 and 110:
z/OS and OS/390 Security Server Sup
Page 111 and 112:
Chapter2Controlling Access to theHi
Page 113 and 114:
Controlling HFS Using the Native UN
Page 115 and 116:
Controlling HFS Using CA SAF HFS Se
Page 117 and 118:
Securing HFS FunctionsKeywordALLCON
Page 119 and 120:
Securing HFS FunctionsFile Function
Page 121 and 122:
Implementing CA SAF HFS SecurityImp
Page 123 and 124:
HFSSEC Control Option+12—The addr
Page 125 and 126:
HFSSEC Control OptionDiagnosticsThe
Page 127 and 128:
HFSSEC Control OptionUNIX CMDCHMOD(
Page 129 and 130:
HFSSEC Control OptionTSSSUTIL EQUIV
Page 131 and 132:
HFSSEC Control OptionUNIX CMDS ACCE
Page 133 and 134:
HFSSEC Control OptionExample 1// JO
Page 135 and 136:
HFSSEC Control OptionExample 2// JO
Page 137 and 138:
MessagesMessagesCAS2301EEVENT PROCE
Page 139 and 140:
MessagesCAS2306Wxxxxxxxxxxxxxxx EVE
Page 141:
MessagesCAS2319ITRACEID=aaaaaaaa US
Page 144 and 145:
The SYSPLEX XES FunctionThere are t
Page 146 and 147:
eTrust CA-Top Secret and the SYSPLE
Page 148 and 149:
Defining the Sysplex to eTrust CA-T
Page 150 and 151:
Managing the Coupling FacilityWhen
Page 152 and 153:
Defining SYSTEM LOGGER to eTrust CA
Page 154 and 155:
IMVSECUR/*=========================
Page 156 and 157:
IMVSECUR/*=========================
Page 158 and 159:
IMVSECURFeature RACF eTrust CA-Top
Page 160 and 161:
PERMITIn eTrust CA-Top Secret, all
Page 163 and 164:
Indexcomponent names for z/OS and O
Page 165 and 166:
OpenEdition MVS supportACIDs needed
show all

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Create successful ePaper yourself

Delete template?

Save as template?