eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

KerberosThe Kerberos password of this realm is children. The default ticket life is 10hours, a minimum ticket life of 30 seconds, and a maximum ticket life of 24hours.Defining Local PrincipalsLocal principals in Kerberos are user acids capable of activity on Unix SystemsServices, who are able to initiate Kerberos commands in the systemcorresponding to the local realm. Kerberos local principals clearly must possessat least the following with sufficient authority to allow access to the OMVS orISHELL shells.■■■■■UIDGROUPDFLTGRPHOMEOMVSPGMWhen a local principal is defined, the affected ACID receives a KERB segment tohold relevant information, some of which will not be available for display. Acorresponding KERBSEGM record will also be defined to the SDT. The label forthe KERBSEGM record is the ACID to which the new segment has been added.The administrator defines Kerberos information for the user as follows:TSS ADD(acid) KERBNAME(principal_name) acid —Specifies the security ACID to be defined with Kerberos information.principal_name—Specifies the Kerberos Principal Name associated with thisuser. This information is added to the KERB segment of the user’s securityrecord. It is also added to the SDT KERBNAME record for high-speedcross-reference indexing. The KERBNAME specified must be unique for eachuser in the local realm. KERBNAME cannot be added to a PROFILE or GROUPACID, nor can it be added to a hierarchy ACID. The fully qualified Kerberosprincipal name is formatted from the KERBDFLT REALMNAME and theKERBNAME principal_name. The combined length cannot exceed 240characters. The principal name cannot include spaces (x’40’) or the “at” sign(x’7F’)./…/local_realm/principal_nameinterval—Specifies the maximum ticket life associated with tickets for this user.The range of available values is 1 – (2**31 – 1). Sensible values for this parametershould not exceed MAXTKTLF for the REALM, and should not be exceeded bythe REALM DEFTKTLF.1–84 Cookbook