eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect
Share Embed Flag
Download ePaper

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

supportconnectw.ca.com
from supportconnectw.ca.com More from this publisher
12.07.2015 Views

Certificate Name Filtering SupportSearch Sequence ScenarioAssume the following records exist and all are trusted. They are listed in the order inwhich they are grouped in the search table.CERTMAP(MAP001) ACID(NJDEPT1)IDNFILTR(OU=Verisign Class 1 Individual Subscriber.O=Verisign,Inc.L=Internet)SDNFILTR(OU=DEPT1.OU=NJ.OU=Sales.O=ABC Co)CERTMAP(MAP002) ACID(NJDEPTX)IDNFILTR(O=Verisign,Inc.L=Internet) SDNFILTR(OU=Sales.O=ABC Co)CERTMAP(MAP003) ACID(NYDEPT2)SDNFILTR(OU=DEPT2.OU=NY,OU=Sales.O=ABC Co)CERTMAP(MAP004) ACID(NYDEPT3)SDNFILTR(OU=DEPT3.OU=NY,OU=Sales.O=ABC Co)CERTMAP(MAP005) ACID(ABCDEPT)SDNFILTR(OU=Sales.O=ABC Co)CERTMAP(MAP006) ACID(ABCTECH)SDNFILTR(OU=R&D.O=ABC Co)CERTMAP(MAP007) ACID(MULTIID)IDNFILTR(O=Verisign,Inc.L=Internet) CRITERIA(CNFAPP=&CNFAPP)CRITMAP(CRT001) ACID(ABCCUST)CNFAPP(ABCINET)CRITMAP(CRT002) ACID(ABCDFLT)CNFAPP(*)Assume a certificate is being presented by a user whose distinguished name is:CN=Bill,OU=Dept4,OU=PA,OU=Sales,O=ABC Co. The issuer’s distinguishedname contains information about That we not VeriSign. How would we processthe search for this certificate?The first two entries don’t match, so we get to the section without an IDNF. Weloop through the SDNFs checking for a match. Then, we take off the CN from thecertificate distinguished name and compare the rest of the certificatedistinguished name against the SDNF. The sections starting with OU=Dept4 andOU=PA will not match. However, the section starting with OU=Sales willprovide a match and the ABCDEPT acid is assigned.Assume a user presents a certificate issued by VeriSign but not for ABC Co. Wewould get a match on CERTMAP MAP007, based on the IDNF information. Thenwe would search the CRITMAP records for a matching CNFAPP. If the CNFAPPwas ABCINET, then acid ABCCUST would be assigned. All other applicationswould be assigned the default acid ABCDFLT.1–80 Cookbook

KerberosKerberosetrust CA-Top Secret can be configured to implement Unix Systems ServicesNetwork Authentication and Privacy Service, known as Kerberos. New recordsin the SDT are defined to provide REALM definitions to describe the local andforeign environments, which the local server is expected to recognize. LocalACIDs are equipped with an additional KERB segment, containing Kerberosinformation, and are mapped for fast access in the SDT. Foreign ACIDs arelinked to local ACIDs through additional SDT definitions.In this chapter, the resource HFSSEC is used for UNIX file security. Forgenerality, if the client does not wish to employ eTrust CA-Top Secret HFSSEC,the IBMFAC(SUPERUSER.) resource may be substituted in the examples below.Local Server ConfigurationInstructions for installing the Kerberos Server are provided in the z/OS NetworkAuthentication Service Administration Guide. In order to implement the KerberosServer SKRBKDC, you will need to define a region ACID for this procedure. Usethe following commands:TSS CREATE(SKRBKDC) NAME(‘kerb server acid’) PASS(NOPW,0)DEPT(sysdept) FACILITY(BATCH,STC,OPENMVS) SOURCE(INTRDR)The ACID will need to have a number of permissions and keywords established.Use the following commands:TSS ADD(SKRBKDC) UID(0) HOME(/etc/skrb/home/kdc) OMVSPGM(/bin/sh) GROUP(omvsgrp)DFLTGRP(omvsgrp)TSS PER(SKRBKDC) HFSSEC(/BIN.SH) ACC(READ,EXEC)TSS PER(SKRBDDC) HFSSEC(/ETC.SKRB) ACC(READ)Additional permissions will be needed, depending on the settings of variables inthe configuration file, /var/skrb/home/kdc/envar. Use the followingcommands:TSS PER(SKRBKDC) HFSSEC(nlspath) ACC(READ,EXEC)TSS PER(SKRBKDC) HFSSEC(nlslocale) ACC(READ,EXEC)The installation defaults are:nlspath: /USR.LPP.SKRB.LIB.NLS.MSG.EN_US$IBM$1047.SKRnlslocale: /USR.LIB.NLS.LOCALE.EN_USThis will differ if you apply a different language path (NLSPATH) in theconfiguration environment.Implementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–81

KerberosKerberosetrust <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> can be configured to implement Unix Systems ServicesNetwork Authentication <strong>and</strong> Privacy Service, known as Kerberos. New recordsin the SDT are defined to provide REALM definitions to describe the local <strong>and</strong><strong>for</strong>eign environments, which the local server is expected to recognize. LocalACIDs are equipped with an additional KERB segment, containing Kerberosin<strong>for</strong>mation, <strong>and</strong> are mapped <strong>for</strong> fast access in the SDT. Foreign ACIDs arelinked to local ACIDs through additional SDT definitions.In this chapter, the resource HFSSEC is used <strong>for</strong> UNIX file security. Forgenerality, if the client does not wish to employ <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> HFSSEC,the IBMFAC(SUPERUSER.) resource may be substituted in the examples below.Local Server ConfigurationInstructions <strong>for</strong> installing the Kerberos Server are provided in the z/<strong>OS</strong> NetworkAuthentication Service Administration Guide. In order to implement the KerberosServer SKRBKDC, you will need to define a region ACID <strong>for</strong> this procedure. Usethe following comm<strong>and</strong>s:TSS CREATE(SKRBKDC) NAME(‘kerb server acid’) PASS(NOPW,0)DEPT(sysdept) FACILITY(BATCH,STC,OPENMVS) SOURCE(INTRDR)The ACID will need to have a number of permissions <strong>and</strong> keywords established.Use the following comm<strong>and</strong>s:TSS ADD(SKRBKDC) UID(0) HOME(/etc/skrb/home/kdc) OMVSPGM(/bin/sh) GROUP(omvsgrp)DFLTGRP(omvsgrp)TSS PER(SKRBKDC) HFSSEC(/BIN.SH) ACC(READ,EXEC)TSS PER(SKRBDDC) HFSSEC(/ETC.SKRB) ACC(READ)Additional permissions will be needed, depending on the settings of variables inthe configuration file, /var/skrb/home/kdc/envar. Use the followingcomm<strong>and</strong>s:TSS PER(SKRBKDC) HFSSEC(nlspath) ACC(READ,EXEC)TSS PER(SKRBKDC) HFSSEC(nlslocale) ACC(READ,EXEC)The installation defaults are:nlspath: /USR.LPP.SKRB.LIB.NLS.MSG.EN_US$IBM$1047.SKRnlslocale: /USR.LIB.NLS.LO<strong>CA</strong>LE.EN_USThis will differ if you apply a different language path (NLSPATH) in theconfiguration environment.Implementing <strong>eTrust</strong> <strong>CA</strong>-<strong>Top</strong> <strong>Secret</strong> in a z/<strong>OS</strong> or <strong>OS</strong>/390 Environment 1–81

logo

products

Resources

Company

Terms of service
Privacy policy
Cookie policy
Cookie settings
Imprint
Change language
Made with love in Switzerland
© 2024 Yumpu.com all rights reserved

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!