Using RACF with UNIX System Services (USS)


Today it is rare to find a System z installation that does not use IBM's UNIX System Services (USS). For security administrators and systems programmers working in a System z/USS environment, a sound understanding of how RACF works with USS is essential.
Designed, written and presented by specialist RACF consultants, this course introduces the USS RACF interface and describes and explains how RACF is utilised within the USS environment.

This course is also available for one-company, on-site presentations and for live presentation over the Internet, via the Virtual Classroom Environment service.

Virtual Classroom Environment dates - click to book!

19 June 2017 15 September 2017

What is a 'Virtual Classroom Environment'?

 

What do I need?

  • webcam
  • headphones with microphone
  • sufficient bandwidth, at least 1.5 Mb/s in each direction.

Objectives

On successful completion of this course you will be able to:

  • describe the necessary requirements to implement a secure UNIX System Services environment
  • understand how to administer file access
  • list the RACF UNIX System Services General Resource Classes
  • move around the UNIX System Services environment and describe the use of shell
  • implement UNIX System Services commands
  • use file systems and ACLs
  • mount and un-mount HFS files
  • understand the use of superuser and UID(0).

Who Should Attend

The course is suitable for all Security Administrators and Systems Programmers responsible for UNIX System Services.

Prerequisites

Attendees should have a clear understanding of z/OS at a conceptual level and have an understanding of RACF that can be gained by attending the course RACF Administration & Auditing. A familiarity with UNIX System Services and a knowledge of TSO/ISPF and JCL is also required.

Duration

1 day

Fee (per attendee)

£450 (ex VAT)

Course Code

RAUS

Contents

Introduction

What are 'Open Systems'?; z/OS USS; Benefits of USS; z/OS USS components; z/OS UNIX interfaces; HFS; SAF for z/OS UNIX; USS security with RACF.

Users & Groups

UNIX user definition; Users & Groups; User & Group Profiles; RACF User/Group profile extensions; UNIX identity; RACF commands for Users; RACF commands for Groups; System Resource limits; OMVS segment - additions; The SEARCH command; Security administration.

Superusers & UID/GID Management

User definition - superuser; BPX.SUPERUSER; Switch to superuser mode; Superuser granularity; UNIPRIV resource names; UNIPRIV class; Managing UIDs; Prevention of shared UIDs; Shared UIDs; Prevention of shared UIDs - example; Search enhancement to map UID & GID; Automatic UID/GID assignment.

Application Identity Mapping

Application Identity Mapping.

z/OS UNIX File Security

Directories & files; UNIX file security; Protecting directories & files; Access levels; The File Security Packet (FSP); Reading File Permissions; Basic - file authorisation checking; File Permission - examples; Protecting files; chmod command examples; chown command - change file owner; chmod - change file mode (permissions); Protecting files; File authorisation checking with UNIXPRIV; RESTRICTED attribute; Default file permissions & umask; List file & directory information.

Access Control Lists (ACLs)

Access Control Lists (ACLs); Three Types of ACL; Two types of Access ACL - base; Two types of Access ACL - extended; Permission Bits & ACLs ; Authority to create ACLs; The getfacl & setfacl commands; getfacl; setfacl; Managing ACLs; getfacl - no ACLs; getfacl - display ACLs for directory; ACL examples; setfacl - change permission bits; ACL examples; ACL inheritance; Directory default ACLs; File default ACLs; getfacl - display all ACLs; UNIXPRIV & ACLs; Authorisation checking - summary; Recommendations.

Security for Daemons & Servers

UNIX level security for Daemons; RACF profiles for daemon security; Server overview; UNIX level security for servers; RACF profiles for server security; Recommendations.

Auditing UNIX System Services Security Events

What can be audited; New RACF classes; RACF commands to implement; SMF records; UNIX commands to audit file access; File Security Packet (FSP); UNIX commands to implement auditing; List file & directory information; Setting the auditing option in the FSP; Auditing the superuser; FSP reporting - HFS Unload.

Interpreting Messages

Interpreting ICH4081 messages; Interpreting BPX messages; Interpreting other messages.


© RSM Technology 2017