eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Lotus Notes Server(To RACF, these commands mark all programs in these libraries as"NOPADCHK". This means that any program-restricted data set accessshould not have to list any of the programs from these libraries. In otherwords, this marks all programs from these libraries as being trusted andtherefore exempt from any program accessed data set / PADS checks. Thesecommands are not applicable to eTrust CA-Top Secret.)6. Install steps, which discuss permission bits and the "sticky bit", are related toOMVS file security itself and are unrelated to RACF. Therefore, such stepsshould be followed as described.Lotus Notes ServerThe Lotus Notes Server (email) can run on a z/OS or OS/390 environment. Theexternal security interface requires a facility and a DOMINO console interface(identified in IBM as DOMCON). This interface facilitates sending commandsfrom z/OS or OS/390 to stop, start and manage Lotus Notes Server runningunder UNIX Systems Services.The Lotus Notes Server requires an acid for the server started task and a groupacid. The following commands accomplish this using the IBM default values.TSS CREATE(LOTUSGRP) TYPE(GROUP) NAME(LOTUSGROUP) DEPT(OMVSDEPT)TSS ADD(LOTUSGRP) GID(6789)TSS CREATE(DOMCON) TYPE(USER) NAME('LOTUS STC ACID') PASS(password,0)DEPT(OMVSDEPT) FACILITY(STC)TSS ADD(DOMCON) GROUP(LOTUSGRP) DFLTGRP(LOTUSGRP)TSS ADD(STC) PROCNAME(?????) ACID(DOMCON)The above command adding the stc should be done for all LOTUS PROCs. Therecan be multiple procs associated with this address space beginning with"DOMIN".TSS ADD(DOMCON) UID(0) HOME(/u/domcon) OMVSPGM(/bin/sh)TSS PERMIT(DOMCON) IBMFAC(BPX.DAEMON) ACCESS(READ)TSS ADD(DEPTACID) DSN(DOMCOM.WTO.LOAD)TSS PERMIT(DOMCON) DSN(DOMCOM.WTO.LOAD) ACCESS(READ)1–50 Cookbook
Lotus Notes and Novell Directory Services for z/OS and OS/390Lotus Notes and Novell Directory Services for z/OS andOS/390This support was introduced at OS/390 V2R8. This enhancement enables eTrustCA-Top Secret to map a user identity from a Lotus Notes or Novell DirectoryServices for z/OS and OS/390 application to a eTrust CA-Top Secret acid. Afteran application has determined a user's eTrust CA-Top Secret acid, it mightchoose to use this acid when accessing MVS resources, such as data sets, andz/OS and OS/390 UNIX System Services (z/OS and OS/390 UNIX) files.An example of the eTrust CA-Top Secret command needed to map a Lotus Notesfor z/OS and OS/390 user identity name would be:TSS ADD(acid) SNAME(lotus user identity name)An example of the eTrust CA-Top Secret command needed to map a NovellDirectory Services for z/OS and OS/390 user identity name would be:TSS ADD(acid) UNAME(Novell Directory Services user identity name)Digital Certificate SupportDigital certificates are a secure method for identifying users, typically through aweb-based application. Digital certificates are encrypted packages issued by atrusted third party called a certificate authority (CA). A certificate is used as anacid and password substitute. Because they are encrypted, digital certificatescannot be tampered with easily. A server can only decrypt them with access tothe proper key. Thus, digital certificates are protected from inspection whilepassing through the network.A digital certificate is associated to a eTrust CA-Top Secret user through theuser's acid record, or the predefined acid CERTAUTH or CERTSITE. More thanone certificate can be issued to a user and eTrust CA-Top Secret allows morethan one certificate to be added to a user's acid record. Since each certificateissued by a certificate authority is unique to a particular user, a certificate cannotbe added to more than one acid. However, more than one acid can use the samecertificate when the certificate is attached to a key ring.A key ring is a collection of digital certificates associated with an individual user.Once a user has had their identity verified to a system by a certificate that isunique to the user, the user can have access to additional resources through thecertificates on their key ring. Key rings provide an installation-wide method toshare digital certificates across multiple servers. A user can have more than onekey ring.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–51
- Page 11 and 12: Chapter1Implementing eTrust CA-TopS
- Page 13 and 14: z/OS and OS/390 CompatibilityThe li
- Page 15 and 16: z/OS and OS/390 Release-Specific Se
- Page 17 and 18: OpenEdition MVS / UNIX System Servi
- Page 19 and 20: OpenEdition MVS / UNIX System Servi
- Page 21 and 22: OpenEdition MVS / UNIX System Servi
- Page 23 and 24: OpenEdition MVS / UNIX System Servi
- Page 25 and 26: OpenEdition MVS / UNIX System Servi
- Page 27 and 28: OpenEdition MVS / UNIX System Servi
- Page 29 and 30: OpenEdition MVS / UNIX System Servi
- Page 31 and 32: Tracing UNIX System Services (OMVS)
- Page 33 and 34: Tracing UNIX System Services (OMVS)
- Page 35 and 36: Tracing UNIX System Services (OMVS)
- Page 37 and 38: Tracing UNIX System Services (OMVS)
- Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
- Page 41 and 42: Using TCP/IPwheresysname is the nam
- Page 43 and 44: Using FTPHow to Secure FTPFTP runs
- Page 45 and 46: Using TELNETTerminal Source Restric
- Page 47 and 48: WebSphere Application Server for z/
- Page 49 and 50: WebSphere Application Server for z/
- Page 51 and 52: WebSphere Application Server for z/
- Page 53 and 54: WebSphere Application Server for z/
- Page 55 and 56: WebSphere Application Server for z/
- Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
- Page 59: Lotus Domino Go WebserverTo disable
- Page 63 and 64: Digital Certificate SupportGeneral
- Page 65 and 66: Digital Certificate SupportFOR|UNTI
- Page 67 and 68: Digital Certificate SupportDCDSN(re
- Page 69 and 70: Digital Certificate SupportNote: In
- Page 71 and 72: Digital Certificate SupportYou can
- Page 73 and 74: Digital Certificate SupportCase #2.
- Page 75 and 76: Digital Certificate SupportImportan
- Page 77 and 78: Digital Certificate SupportAdding a
- Page 79 and 80: Digital Certificate SupportReconnec
- Page 81 and 82: Digital Certificate SupportTSS LIST
- Page 83 and 84: Certificate Name Filtering SupportT
- Page 85 and 86: Certificate Name Filtering SupportI
- Page 87 and 88: Certificate Name Filtering SupportD
- Page 89 and 90: Certificate Name Filtering SupportL
- Page 91 and 92: KerberosKerberosetrust CA-Top Secre
- Page 93 and 94: KerberosThe command syntax for this
- Page 95 and 96: KerberosThe following command creat
- Page 97 and 98: Mapping of Foreign EnvironmentsMapp
- Page 99 and 100: Mapping of Foreign EnvironmentsMapp
- Page 101 and 102: Distributed File Server SMB SUPPORT
- Page 103 and 104: NFS (Network File System)The first
- Page 105 and 106: z/OS and OS/390 Security Server Sup
- Page 107 and 108: z/OS and OS/390 Security Server Sup
- Page 109 and 110: z/OS and OS/390 Security Server Sup
Lotus Notes <strong>and</strong> Novell Directory Services <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390Lotus Notes <strong>and</strong> Novell Directory Services <strong>for</strong> z/<strong>OS</strong> <strong>and</strong><strong>OS</strong>/390This support was introduced at <strong>OS</strong>/390 V2R8. This enhancement enables <strong>eTrust</strong><strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> to map a user identity from a Lotus Notes or Novell DirectoryServices <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 application to a <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> acid. Afteran application has determined a user's <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> acid, it mightchoose to use this acid when accessing MVS resources, such as data sets, <strong>and</strong>z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 UNIX System Services (z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 UNIX) files.An example of the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> comm<strong>and</strong> needed to map a Lotus Notes<strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 user identity name would be:TSS ADD(acid) SNAME(lotus user identity name)An example of the <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> comm<strong>and</strong> needed to map a NovellDirectory Services <strong>for</strong> z/<strong>OS</strong> <strong>and</strong> <strong>OS</strong>/390 user identity name would be:TSS ADD(acid) UNAME(Novell Directory Services user identity name)Digital Certificate SupportDigital certificates are a secure method <strong>for</strong> identifying users, typically through aweb-based application. Digital certificates are encrypted packages issued by atrusted third party called a certificate authority (<strong>CA</strong>). A certificate is used as anacid <strong>and</strong> password substitute. Because they are encrypted, digital certificatescannot be tampered with easily. A server can only decrypt them with access tothe proper key. Thus, digital certificates are protected from inspection whilepassing through the network.A digital certificate is associated to a <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> user through theuser's acid record, or the predefined acid CERTAUTH or CERTSITE. More thanone certificate can be issued to a user <strong>and</strong> <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> allows morethan one certificate to be added to a user's acid record. Since each certificateissued by a certificate authority is unique to a particular user, a certificate cannotbe added to more than one acid. However, more than one acid can use the samecertificate when the certificate is attached to a key ring.A key ring is a collection of digital certificates associated with an individual user.Once a user has had their identity verified to a system by a certificate that isunique to the user, the user can have access to additional resources through thecertificates on their key ring. Key rings provide an installation-wide method toshare digital certificates across multiple servers. A user can have more than onekey ring.Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–51
Change language