eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

KerberosYou will also want to be able to write to the STDOUT and STDERR files specifiedin your file. In the Kerberos configuration file, the variablesEUV_SVC_STDOUT_FILENAMEEUV_SVC_STDERR_FILENAMEwill contain the file names required. The following permissions will allow allaccess to the STDERR and STDOUT files suppled by default:TSS PER(SKRBKDC) HFSSEC(/VAR.SKRB.LOGS.) ACC(ALL)To allow the server to read and write credentials, use the following commands:TSS PER(SKRBKDC) HFSSEC(/VAR.SKRB.CREDS) ACC(ALL)After you have defined the ACID and provided proper access, you may add theprocedure to the STC using the following command:TSS ADD(STC) PROCNAME(SKRBKDC) ACID(SKRBKDC)Customizing your Local EnvironmentThe default_realm specification is also known as the “local” realm. The otherrealms defined in the configuration are known as “foreign” realms. Realms aredefined in the SDT.Users defined to Kerberos are not defined in the configuration file, but must bedefined entirely through the Security File. Users defined in the local realm areknown as “local” principals. Only local principals are allowed to initiateKerberos commands from the local Unix Systems Services. Users defined in aforeign realm are mapped in the SDT with a surrogate user in the local realm.We will see how the security environment must be customized to interact withKerberos.Defining Your Local RealmYou must define to the Security File the REALMs defined to your Kerberosconfiguration file./etc/skrb/krb5.confThe local realm is specified in your default_realm parameter. The local REALMis always named KERBDFLT and must be defined before the local principals aredefined.1–82 Cookbook