Quick security setup for RACF

If you are using RACF® as your security product, the quickest way to set up CIM server security is using the job CFZSEC provided in the installation SAMPLIB.

With little customization, this sample provides a working security setup for CIM, which allows you to start the CIM server and users or applications to connect to the CIM server.

Please note that the CFZSEC job is meant for a quick setup only. It is not recommended to use it as the final configuration without having reviewed the details of the CIM security setup described in CIM server security setup.

__ 1.

Review the CFZSEC job and customize the following steps:

Required updates:

__ a.

If profile BPX.SERVER in the FACILITY class is active on your system, you should change the UID for CFZSRV to a value other than 0 in step CRUSR. In this case, the default for the UID is 9500. If the profile is not already active on your system, it is recommended to define the CIM server user with a UID of 0 in the initial setup for simplicity reasons.

Note:

Do not assign a password to the CFZSRV user ID.

__ b.

If you are using the z/OS Resource Measurement Facility™ (RMF™) optional element, replace #rkeymask with a 16-digit (0-9, A-F) keymask value to set up the connectivity between CIM and RMF via PassTickets. Otherwise, you may remove the step ENRMF from the job.

Note:

The keymask value is a secret passkey. In a secure environment it is recommended to perform step ENRMF separately to avoid storing the passkey in the job log in readable format.

Optional changes:

_ Check that the GIDs (9501-9503) used in step CRUSR are not already in use on your system, otherwise change them.

For details on each step of the CFZSEC job see Step-by-step explanation of the CFZSEC job.

__ 2.

Submit CFZSEC

Please note that, because this job provides a solution for each configuration, necessarily the job steps which do not apply to your system will fail. This does not affect the job’s functionality.

__ 3.

Authorize users to CIM by connecting them to group CFZUSRGP

Be sure to have at least one user authorized for CIM in order to run the Installation Verification Procedure as described in Step 6: Running the installation verification program (IVP).