eTrust CA-Top Secret Security for z/OS and OS ... - SupportConnect

KerberosIt must be placed earlier in the path than the following to avoid DCE/Kerberosfrom overriding more recent Kerberos software./binAny /bin DCE subdirectoryAny Kerberos session variables which the user wishes to set differently than thevalues in the Kerberos environment file should be set in the user’s .profile file.Consult IBM SecureWay Security Server Network Authentication ServiceAdministration for complete details. If any file names are specified, theadministrator must provide appropriate HFSSEC permissions in order to accessthem.DCE IncompatibilityDCE commands conflict with Kerberos commands. Clients wishing to make useof these separate features should make changes to their environments as outlinedin IBM SecureWay Security Server Network Authentication ServiceAdministration.Security ConsiderationsA number of attributes must be present on an ACID in order to assure thecapability for the Kerberos kinit function. The assumption for examples here isthat HFSSEC(ON) has been set:■■■■■■The ACID must be given standard OMVS attributes:TSS ADD(local) UID(uid_number) GROUP(omvsgrp) DFLTGRP(omvsgrp)HOME(home_directory) OMVSPGM(program_directory)The ACID must be given permission to change the mode of their own files:TSS PERMIT(local) IBMFAC(BPX.CAHFS.FILE.MODE)The ACID must be able to create, alter, execute and read files in the homedirectory. Kerberos credentials will be created in this directory.TSS PERMIT(local) HFSSEC(home_directory) ACC(ALL)The ACID must be able to READ and EXECUTE files in the programdirectory.TSS PERMIT(local) HFSSEC(program_directory) ACC(READ,EXEC)To access Kerberos command files at run-time, the user will need thefollowing:TSS PER(useracid) HFSSEC(/usr.lpp.skrb.bin)To access Kerberos EXEC files enter the following commands:TSS PER(useracid) DATASET(EUVF.SEUVFEXC) ACC(READ)1–86 Cookbook