eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Superuser Granularity ................................................................... 1–16CHOWN UNRESTRICTED (Control Option) ........................................... 1–18z/OS and OS/390 UNIX System Services: User Limits ...................................... 1–18z/OS and OS/390 ServerPac upgrade ..................................................... 1–19Logging UNIX System Services Security Calls .............................................. 1–19Tracing UNIX System Services (OMVS) ....................................................... 1–20UNIX System Services Reporting.......................................................... 1–21TSSOERPT Output Description ....................................................... 1–23Using TCP/IP............................................................................... 1–29Establishing Security for TCP/IP and OE/TCPIP (Communications Server IP for z/OS and OS/390)........................................................................................ 1–29TCP/IP SERVAUTH Class ............................................................... 1–30VMCF and TNF subsystems (eTrust CA-Top Secret started before JES) ....................... 1–31IP Address Protection .................................................................... 1–32Using FTP .................................................................................. 1–32How to Secure FTP ...................................................................... 1–33How to Secure FTP for UNIX System Services .............................................. 1–33Using TELNET.............................................................................. 1–35How to Secure TELNET for UNIX System Services ......................................... 1–35InfoPrint Server for z/OS and OS/390 (z/OS and OS/390 Print Server) .......................... 1–36WebSphere Application Server for z/OS AND OS/390 ......................................... 1–36Authorization Checking.................................................................. 1–38Server Authorization Checking........................................................ 1–39Level of Trust and Authority for Regions............................................... 1–39User Identification, Authentication and Network Security ................................... 1–40Identification and Authentication ..................................................... 1–43WASADM .............................................................................. 1–43Security Auditing........................................................................ 1–47Lotus Domino Go Webserver ................................................................. 1–47Installing Domino Go Webserver on a eTrust CA-Top Secret-secured System.................. 1–48Lotus Notes Server .......................................................................... 1–50Lotus Notes and Novell Directory Services for z/OS and OS/390 ................................ 1–51Digital Certificate Support ................................................................... 1–51Associating a Unique Digital Certificate with a User ........................................ 1–52General Rules ........................................................................... 1–53Third Party Vendors ..................................................................... 1–53Adding a Digital Certificate to an ACID Record ............................................ 1–54Generating a Digital Certificate and Adding It to a User ..................................... 1–56Listing Digital Certificate Information ..................................................... 1–60Generating a Certificate Request .......................................................... 1–61Changing a User's Certificate ............................................................. 1–62ivSecurity Cookbook
Certificate Replacement (Renewal)......................................................... 1–62Changing a Certificate's Status ............................................................ 1–63Changing a Certificate's Label ............................................................. 1–63Removing a Certificate from a User ........................................................ 1–64Determining if a Certificate has been Added to eTrust CA-Top Secret ......................... 1–64Exporting Certificates to Data Sets ......................................................... 1–65Sharing Certificates on Key Rings.......................................................... 1–66Creating a Key Ring .................................................................. 1–66Adding a Certificate to a Key Ring ..................................................... 1–67Removing a Key ring from an acid ..................................................... 1–67Extracting Certificates from Key Rings ..................................................... 1–68Extracting Private Keys ................................................................... 1–68Reconnecting Private Keys ................................................................ 1–69Listing Key Ring Information ............................................................. 1–69Managing Certificate Serial Numbers ...................................................... 1–69CERTADM .............................................................................. 1–70Certificate Name Filtering Support ............................................................ 1–73Managing Certificate Name Filters......................................................... 1–75Managing Criteria Maps .................................................................. 1–77Creating Certificate Name Filter Scenarios.................................................. 1–78Listing Filtering Information .............................................................. 1–79Init ACEE Changes for Search Sequence.................................................... 1–79Search Sequence Scenario ............................................................. 1–80Kerberos .................................................................................... 1–81Local Server Configuration................................................................ 1–81Customizing your Local Environment...................................................... 1–82Defining Your Local Realm ............................................................... 1–82Defining Local Principals ................................................................. 1–84Password Change Server ACID ........................................................... 1–85Preparing Local Principal ACIDs for Kerberos .............................................. 1–85DCE Incompatibility.................................................................. 1–86Security Considerations ............................................................... 1–86Mapping of Foreign Environments ............................................................ 1–87Mapping Foreign Realms ................................................................. 1–87Mapping Foreign Principal Names......................................................... 1–89DCE Support ................................................................................ 1–90Distributed File Service (DFS) ................................................................. 1–90Distributed File Server SMB SUPPORT ........................................................ 1–91SMB ENCRYPTED PASSWORD SUPPORT................................................. 1–91NFS (Network File System) ................................................................... 1–92eTrust CA-Top Secret Support for z/OS and OS/390 NFS.................................... 1–93Contentsv
- Page 1 and 2: eTrust CA-Top Secret ® Securityfo
- Page 3: Technical UpdatesMay 2003The follow
- Page 8 and 9: WLM (Workload Management)..........
- Page 11 and 12: Chapter1Implementing eTrust CA-TopS
- Page 13 and 14: z/OS and OS/390 CompatibilityThe li
- Page 15 and 16: z/OS and OS/390 Release-Specific Se
- Page 17 and 18: OpenEdition MVS / UNIX System Servi
- Page 19 and 20: OpenEdition MVS / UNIX System Servi
- Page 21 and 22: OpenEdition MVS / UNIX System Servi
- Page 23 and 24: OpenEdition MVS / UNIX System Servi
- Page 25 and 26: OpenEdition MVS / UNIX System Servi
- Page 27 and 28: OpenEdition MVS / UNIX System Servi
- Page 29 and 30: OpenEdition MVS / UNIX System Servi
- Page 31 and 32: Tracing UNIX System Services (OMVS)
- Page 33 and 34: Tracing UNIX System Services (OMVS)
- Page 35 and 36: Tracing UNIX System Services (OMVS)
- Page 37 and 38: Tracing UNIX System Services (OMVS)
- Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
- Page 41 and 42: Using TCP/IPwheresysname is the nam
- Page 43 and 44: Using FTPHow to Secure FTPFTP runs
- Page 45 and 46: Using TELNETTerminal Source Restric
- Page 47 and 48: WebSphere Application Server for z/
- Page 49 and 50: WebSphere Application Server for z/
- Page 51 and 52: WebSphere Application Server for z/
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
Superuser Granularity ................................................................... 1–16CHOWN UNRESTRICTED (Control Option) ........................................... 1–18z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 UNIX System Services: User Limits ...................................... 1–18z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 ServerPac upgrade ..................................................... 1–19Logging UNIX System Services <strong>Security</strong> Calls .............................................. 1–19Tracing UNIX System Services (OMVS) ....................................................... 1–20UNIX System Services Reporting.......................................................... 1–21TSSOERPT Output Description ....................................................... 1–23Using TCP/IP............................................................................... 1–29Establishing <strong>Security</strong> <strong>for</strong> TCP/IP <strong>and</strong> OE/TCPIP (Communications Server IP <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390)........................................................................................ 1–29TCP/IP SERVAUTH Class ............................................................... 1–30VMCF <strong>and</strong> TNF subsystems (<strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> started be<strong>for</strong>e JES) ....................... 1–31IP Address Protection .................................................................... 1–32Using FTP .................................................................................. 1–32How to Secure FTP ...................................................................... 1–33How to Secure FTP <strong>for</strong> UNIX System Services .............................................. 1–33Using TELNET.............................................................................. 1–35How to Secure TELNET <strong>for</strong> UNIX System Services ......................................... 1–35InfoPrint Server <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 (z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 Print Server) .......................... 1–36WebSphere Application Server <strong>for</strong> z/<strong>OS</strong> AND <strong>OS</strong>/390 ......................................... 1–36Authorization Checking.................................................................. 1–38Server Authorization Checking........................................................ 1–39Level of Trust <strong>and</strong> Authority <strong>for</strong> Regions............................................... 1–39User Identification, Authentication <strong>and</strong> Network <strong>Security</strong> ................................... 1–40Identification <strong>and</strong> Authentication ..................................................... 1–43WASADM .............................................................................. 1–43<strong>Security</strong> Auditing........................................................................ 1–47Lotus Domino Go Webserver ................................................................. 1–47Installing Domino Go Webserver on a <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong>-secured System.................. 1–48Lotus Notes Server .......................................................................... 1–50Lotus Notes <strong>and</strong> Novell Directory Services <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 ................................ 1–51Digital Certificate Support ................................................................... 1–51Associating a Unique Digital Certificate with a User ........................................ 1–52General Rules ........................................................................... 1–53Third Party Vendors ..................................................................... 1–53Adding a Digital Certificate to an ACID Record ............................................ 1–54Generating a Digital Certificate <strong>and</strong> Adding It to a User ..................................... 1–56Listing Digital Certificate In<strong>for</strong>mation ..................................................... 1–60Generating a Certificate Request .......................................................... 1–61Changing a User's Certificate ............................................................. 1–62iv<strong>Security</strong> Cookbook
Change language