eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

More documents

Recommendations

Info

Digital Certificate SupportAn application can increment the “last serial number issued” for a CERTAUTHor CERTSITE certificate if the following conditions are met:■■The caller’s user ID is the user ID associated with the certificateThe caller’s user ID has at least CONTROL authority to the IBMFACresource IRR.DIGTCERT.GENCERTTSS PER(acid) IBMFAC(IRR.DIGTCERT.GENCERT) ACCESS(CONTROL)CERTADMThe following is a copy of the eTrust CA-Top Secret supplied command list,CERTADM. This list contains sample Digital Certificate commands that presentthe various Digital Certificate supported functional keywords./*=====================================================================*//*Basic Self-signed Digital Certificate *//*=====================================================================*/TSS CREATE(GENCDIV) TYPE(DIV) NAME('GENCERT DIVISION')TSS CREATE(GENCDEPT) TYPE(DEPT) DIV(GENCDIV)TSS CREATE(MARY001) NAME('GENCERT USER MARY') TYPE(USER) -PASSWORD(123,0) DEPT(GENCDEPT)TSS GENCERT(MARY001) DIGICERT(MARYCERT)TSS LIST(MARY001) DATA(ALL,PASSWORD)TSS REPLACE(MARY001) DIGICERT(MARYCERT) -LABLCERT('SELF-SIGNED PRIVATE KEY FOR MARY')TSS LIST(MARY001) LABLCERT('SELF-SIGNED PRIVATE KEY FOR MARY')TSS LIST(SDT) DIGICERT(ALL)TSS LIST(MARY001) SEGMENT(CERTDATA)/*=====================================================================*//*Create 5 Digital Certificates & add to the same user acid) *//*=====================================================================*/TSS CREATE(GENCDIV) TYPE(DIV) NAME('GENCERT DIVISION')TSS CREATE(GENCDEPT) TYPE(DEPT) DIV(GENCDIV) -NAME('GENCERT DEPARTMENT')TSS CREATE(JAMES01) NAME('GENCERT USER JAMES') TYPE(USER) -PASSWORD(123,0) DEPT(GENCDEPT)TSS LIST(JAMES01) DATA(ALL,PASSWORD)TSS GENCERT(JAMES01) DIGICERT(JIM01) LABLCERT('1ST D.CERT FOR JIM') -KEYSIZE(512) KEYUSAGE(HANDSHAKE) ALTNAME('IP=203.9.102.100')TSS LIST(JAMES01) DATA(ALL,PASSWORD)TSS LIST(SDT) DIGICERT(ALL)TSS GENCERT(JAMES01) DIGICERT(JIM02) LABLCERT('2ND D.CERT FOR JIM') -NBDATE(10/01/02) NBTIME(08:00:00) -NADATE(10/01/03) NATIME(09:00:00) -KEYUSAGE(DATAENCRYPT) KEYSIZE(768) ALTNAME(DOMAIN=CA.COM) -SUBJECTN('CN="JAMES SECOND DIGICERT"')TSS LIST(JAMES01) DIGICERT(JIM02)TSS LIST(SDT) DIGICERT(ALL)TSS GENCERT(JAMES01) DIGICERT(JIM03) -NBDATE(10/01/02) NBTIME(08:00:00) -NADATE(10/31/03) NATIME(09:00:00) -KEYSIZE(1024) -LABLCERT('3RD D.CERT FOR JIM') -KEYUSAGE(DOCSIGN) -ALTNAME('IP=201.100.10.9 EMAIL=JAMES03@TEST.NET') -SUBJECTN('T="THIRD BOOK OF JAMES" OU=PAYROLL')1–70 Cookbook
Digital Certificate SupportTSS LIST(JAMES01) DIGICERT(JIM03)TSS LIST(SDT) DIGICERT(ALL)TSS GENCERT(JAMES01) DIGICERT(JIM04) -SUBJECTN('CN="JIM DOUGLAS" O=CA ST="NEW JERSEY" C=US -T="TEST GENCERT" L="NO. BRUNSWICK"') -KEYSIZE(1024) -LABLCERT('4TH D.CERT FOR JIM') -KEYUSAGE(CERTSIGN) -ALTNAME(URI=WWW.CA.COM)TSS LIST(JAMES01) DIGICERT(JIM04)TSS LIST(SDT) DIGICERT(ALL)TSS GENCERT(JAMES01) DIGICERT(JIM05) -SUBJECTN('CN=JIM05 O=CA ST=NJ C=US') -NBDATE(10/01/02) NADATE(10/30/03) -NBTIME(08:00:00) NATIME(09:00:00) -KEYSIZE(1024) -LABLCERT('5TH DIGICERT FOR JIM') -ICSF -KEYUSAGE(CERTSIGN) -ALTNAME('IP=201.100.10.9 EMAIL=JAMES05@TEST.NET DOMAIN=CA.COM -URI=WWW.CA.COM')TSS LIST(JAMES01) DIGICERT(JIM05)TSS LIST(JAMES01) DATA(ALL,PASSWORD)TSS LIST(SDT) DIGICERT(ALL)/*=====================================================================*//*To Generate a Digital Certificate with keyword SIGNWITH & Remove *//* Digicert *//*=====================================================================*/TSS CREATE(GENCDIV) TYPE(DIV) NAME('GENCERT DIVISION')TSS CREATE(GENCDEPT) TYPE(DEPT) DIV(GENCDIV) -NAME('GENCERT DEPARTMENT')TSS CREATE(MARY001) NAME('GENCERT USER MARY') TYPE(USER) -PASSWORD(123,0) DEPT(GENCDEPT)TSS GENCERT(MARY001) DIGICERT(MARYCERT) –LABLCERT('SELF-SIGNED PRIVATE KEY FOR MARY')TSS LIST(MARY001) DATA(ALL,PASSWORD)TSS CREATE(TEDD001) NAME('GENCERT USER TEDD') TYPE(USER) -PASSWORD(123,0) DEPT(GENCDEPT)TSS LIST(TEDD001) DATA(ALL,PASSWORD)TSS GENCERT(TEDD001) DIGICERT(TEDCERT1) -SIGNWITH(MARY001,MARYCERT)TSS LIST(TEDD001) DATA(ALL,PASSWORD)TSS LIST(TEDD001) DIGICERT(TEDCERT1)TSS LIST(SDT) DIGICERT(ALL)TSS REMOVE(TEDD001) DIGICERT(TEDCERT1)/*=====================================================================*//*To Generate a Digital Certificate Request and write it to a data set.*//* (GENREQ) *//*=====================================================================*/TSS CREATE(GENCDIV) TYPE(DIV) NAME('GENCERT DIVISION')TSS CREATE(GENCDEPT) TYPE(DEPT) DIV(GENCDIV) -NAME('GENCERT DEPARTMENT')TSS CREATE(MARY001) NAME('GENCERT USER MARY') TYPE(USER) -PASSWORD(123,0) DEPT(GENCDEPT)TSS GENCERT(MARY001) DIGICERT(MARYCERT) –LABLCERT('SELF-SIGNED PRIVATE KEY FOR MARY')TSS LIST(MARY001) DATA(ALL,PASSWORD)TSS GENREQ(MARY001) DIGICERT(MARYCERT) -DCDSN(QAPRN.GENREQ.MARYCERT) -Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–71
Page 1 and 2:
eTrust CA-Top Secret ® Securityfo
Page 3:
Technical UpdatesMay 2003The follow
Page 6 and 7:
Superuser Granularity .............
Page 8 and 9:
WLM (Workload Management)..........
Page 11 and 12:
Chapter1Implementing eTrust CA-TopS
Page 13 and 14:
z/OS and OS/390 CompatibilityThe li
Page 15 and 16:
z/OS and OS/390 Release-Specific Se
Page 17 and 18:
OpenEdition MVS / UNIX System Servi
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26:
Page 27 and 28:
Page 29 and 30: OpenEdition MVS / UNIX System Servi
Page 31 and 32: Tracing UNIX System Services (OMVS)
Page 39 and 40: Using TCP/IPFILE AUDIT OPTIONS—Th
Page 41 and 42: Using TCP/IPwheresysname is the nam
Page 43 and 44: Using FTPHow to Secure FTPFTP runs
Page 45 and 46: Using TELNETTerminal Source Restric
Page 47 and 48: WebSphere Application Server for z/
Page 57 and 58: Lotus Domino Go Webserver/* PERMITT
Page 59 and 60: Lotus Domino Go WebserverTo disable
Page 61 and 62: Lotus Notes and Novell Directory Se
Page 63 and 64: Digital Certificate SupportGeneral
Page 65 and 66: Digital Certificate SupportFOR|UNTI
Page 67 and 68: Digital Certificate SupportDCDSN(re
Page 69 and 70: Digital Certificate SupportNote: In
Page 71 and 72: Digital Certificate SupportYou can
Page 73 and 74: Digital Certificate SupportCase #2.
Page 75 and 76: Digital Certificate SupportImportan
Page 77 and 78: Digital Certificate SupportAdding a
Page 79: Digital Certificate SupportReconnec
Page 83 and 84: Certificate Name Filtering SupportT
Page 85 and 86: Certificate Name Filtering SupportI
Page 87 and 88: Certificate Name Filtering SupportD
Page 89 and 90: Certificate Name Filtering SupportL
Page 91 and 92: KerberosKerberosetrust CA-Top Secre
Page 93 and 94: KerberosThe command syntax for this
Page 95 and 96: KerberosThe following command creat
Page 97 and 98: Mapping of Foreign EnvironmentsMapp
Page 99 and 100: Mapping of Foreign EnvironmentsMapp
Page 101 and 102: Distributed File Server SMB SUPPORT
Page 103 and 104: NFS (Network File System)The first
Page 105 and 106: z/OS and OS/390 Security Server Sup
Page 111 and 112: Chapter2Controlling Access to theHi
Page 113 and 114: Controlling HFS Using the Native UN
Page 115 and 116: Controlling HFS Using CA SAF HFS Se
Page 117 and 118: Securing HFS FunctionsKeywordALLCON
Page 119 and 120: Securing HFS FunctionsFile Function
Page 121 and 122: Implementing CA SAF HFS SecurityImp
Page 123 and 124: HFSSEC Control Option+12—The addr
Page 125 and 126: HFSSEC Control OptionDiagnosticsThe
Page 127 and 128: HFSSEC Control OptionUNIX CMDCHMOD(
Page 129 and 130: HFSSEC Control OptionTSSSUTIL EQUIV
Page 131 and 132:
HFSSEC Control OptionUNIX CMDS ACCE
Page 133 and 134:
HFSSEC Control OptionExample 1// JO
Page 135 and 136:
HFSSEC Control OptionExample 2// JO
Page 137 and 138:
MessagesMessagesCAS2301EEVENT PROCE
Page 139 and 140:
MessagesCAS2306Wxxxxxxxxxxxxxxx EVE
Page 141:
MessagesCAS2319ITRACEID=aaaaaaaa US
Page 144 and 145:
The SYSPLEX XES FunctionThere are t
Page 146 and 147:
eTrust CA-Top Secret and the SYSPLE
Page 148 and 149:
Defining the Sysplex to eTrust CA-T
Page 150 and 151:
Managing the Coupling FacilityWhen
Page 152 and 153:
Defining SYSTEM LOGGER to eTrust CA
Page 154 and 155:
IMVSECUR/*=========================
Page 156 and 157:
IMVSECUR/*=========================
Page 158 and 159:
IMVSECURFeature RACF eTrust CA-Top
Page 160 and 161:
PERMITIn eTrust CA-Top Secret, all
Page 163 and 164:
Indexcomponent names for z/OS and O
Page 165 and 166:
OpenEdition MVS supportACIDs needed
show all

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

Create successful ePaper yourself

Delete template?

Save as template?