eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

KerberosThe command syntax for this definition is given by:TSS ADDTO(SDT) REALM(KERBDFLT) REALMNAME(default_realm) KERBPASS(Kerberos-password)REALM—KERBDFLT (required)REALMNAME—Must be identical to configuration file default_realm.etrust CA-Top Secret has simplified the REALMNAME specification. This isinternally expanded to the following when used for run-time security checks:/…/default_realm/krbtgt/default_realmThe REALMNAME is generally specified in the form of a first orderweb-address. It can be a maximum of 117 characters, but cannot include spaces(x’40’) or the at-sign (x’7F’).Note: Because the relationship between the REALMNAME and generatingKerberos tickets for principal users is based, in part, on the local REALMNAME,care must be taken when choosing a REALMNAME. Renaming the REALMshould be avoided at all costs during Kerberos operations, since trust relations inflight will cause unpredictable effects.MINTKTLF—Specifies the maximum ticket life in seconds, and is representedby a numeric value between 1 and 2 147 483 647. Note that 0 is not a valid value.This keyword is only applicable when defining the KERBDFLT realm record. IfMAXTKTLF is specified, DEFTKTLF and MINTKTLF must also be specified.DEFTKTLF—Specifies the time intervals (in seconds) that a Kerberos generatedticket will remain active in the realm. If any of these intervals is specified, allmust be specified. If no intervals are specified, tickets are not limited. Validvalues for these parameters lie in the range 1 through 2**31-1 (2147483647). Asyou would expect, MAXTKTLF >= DEFTKTLF >= MINTKTLF is enforced.KERBPASS—Specifies a 1-8 character password (alphanumeric) for the localrealm. When the same realm name is used as a foreign realm in a foreignKerberos system, the passwords must be identical. Passwords are case-sensitiveand are maintained in the case in which they are entered. The KERBPASS bearsno relationship to the password of the SKRBKDC region ACID.Example:TSS ADDTO(SDT) REALM(KERBDFLT) REALMNAME(local.ca.com) MINTKTLF(30)MAXTKTLF(86400) DEFTKTLF(36000) KERBPASS(children)In the above example, the realm name is KERBDFLT, which identifies this recordas the default realm record. The Kerberos realm name is local.ca.com. Thiscorresponds to a the following fully qualified Kerberos security name whicheTrust CA-Top Secret will format automatically./…/local.ca.com/kerbtgt/local.ca.comImplementing eTrust CA-Top Secret in a z/OS or OS/390 Environment 1–83