Note: Secure Configuration Guide for z/VM, SC24-6323, describes installing and customizing z/VM and RACF in a way that meets requirements for certification for the Common Criteria Operating System Protection Profile (OSPP). This chapter does not describe all of the steps that are involved in setting up the certified configuration. However, important basic steps are outlined in Secure Configuration Guide for z/VM, SC24-6323 that are important for a normal RACF installation.

Note: The default action that is taken by RACF is to defer to CP. For more information about this action and how to change this default action, see 4.2.5, “Using HCPRWAC” on page 85.

Note: For more information about how to start implementing a security policy by using RACF, see Chapter 2, “Organizing for RACF Implementation” of RACF Security Server Security Administrator’s Guide, SC24-6311.

Note: Make sure that your installation includes a license for RACF before you activate it.

Note: In this example, we decided not to delete these minidisks, but rather to move them to a different address so that we can use them as the source for copying the supplied initialized primary and backup databases later in the process. This action also provides a number of disks across the system that can be used as destinations for backing up the databases. Backing up the RACF database is described in 4.3.7, “Backing up the RACF database” on page 103.

Note: If your configuration does not have symmetric device addressing (that is, the RACF database disks do not have the same device address across all members of the SSI cluster), you must add the disks to each SUBCONFIG entry by using the appropriate device addresses.

Note: If you use IBM Geographically Dispersed Parallel Sysplex (GDPS), you cannot use the DEVNO parameter on MDISK statements. Instead, you must follow the instructions that are contained in the Program Directory for defining the RACFVM 200 and 300 disks.

Note: The batch file is not the only way to complete this task. You can issue each of the commands in the batch file separately, or you can use DIRM GET command to retrieve each of the RACMAINT SUBCONFIG entries, edit the files directly, and use the DIRM REPLACE command to update them.

Note: Run the CPSYNTAX utility over your SYSTEM CONFIG file after making any changes. In an SSI configuration, you must use the LPAR option to test the SSI multi-configuration nature of SYSTEM CONFIG. Run this once for each logical partition (LPAR) in your SSI configuration, even if you believe that you made a change that needs to be tested once.

Note: For more information about how to move from minidisk to full-pack if an increase in the database allocation is needed, see RACF Security Server System Programmer’s Guide, SC24-6312.

Note: The use of the RPIDIRCT command creates a user with a NOLOG or UNLOG password with the NOPASS, NOPHRASE, and REVOKED set. However, the DirMaint-RACF connector sets only REVOKED for a NOLOG user. If your installation performs all password management by using DirMaint, this issue is not important because the connector resets the password field in RACF if the user is migrated out of NOLOG status.

USER WITHPASS Filemode defaulted to "*". Output defaulted to "A" disk. Default group ID = SYS1. Would you like to change this default? Enter Y/N N Default group ID = SYS1.   PROFILE IBMDFLT   PROFILE TCPCMSU   PROFILE TCPGCSU --------------------  4277 line(s) not displayed ------------ ********** 5531 Directory records processed **************** *************** RPIDIRCT SYSUT1 CREATED ********************

Note: If many guest virtual network connections or a complex virtual network configuration exist, you might decide to leave activating the VMLAN class until after the rest of RACF configuration is stabilized. You can defer the activation of VMLAN until a later time by commenting out the SETROPTS CLASSACT(VMLAN) command from the RPIDIRCT SYSUT1 file. Resource profiles and permit statements that are contained in RPIDIRCT SYSUT1 are defined to the RACF database, but the class is not activated; therefore, your virtual network permission structure is retained. Take the time to implement VMLAN when the RACF is installed. It might not be feasible to return at a later and implement the required changes.

Note: For more information about enabling and working with KDFAES, including considerations for enabling this mode, see “RACF KDFAES algorithm” on page 122.

Note: The new CP nucleus, with the RACF CP parts, is placed on the secondary parm disk (MAINT710 CF2). For your information, a copy of the previous (or currently running) CPLOAD MODULE is still on the primary (CF1) and tertiary (CF3) parm disks as CPLOAD MODULE. It is also saved on the secondary parm disk as CPLOLD MODULE.

Note: When z/VM SSI was introduced, the locations and roles of the parm disks changed. Previously, all of the parm disks were owned by MAINT and contained the CP nucleus, system configuration file, and logo configuration. With SSI, a new parm disk that is owned by the PMAINT user holds the system and logo configuration files, a second parm disk that is owned by the MAINT710 user is used during the service process, and a separate pair of disks that is owned by MAINT on each member of the SSI cluster holds the CP nucleus for that member.

Note: If Auto_Warm_IPL is coded in your SYSTEM CONFIG file, you must also add the IPL parameter PROMPT on the SALIPL pane.

Note: On our system, we found that IBMUSER included a disk that is linked at 305, which we detached so that we can perform these steps.

Note: A highly experienced RACF administrator with extensive knowledge of VMSES/E might set up RACF profiles and permissions that allow access to the required resources without the OPERATIONS attribute. Because the maintenance of z/VM and its features is of critical importance to the system operation, the recommended approach of using OPERATIONS is the preferred method for most installations.

Note: As a preferred practice before granting the OPERATOR user the SPECIAL attribute, consider all possible alternatives. Giving OPERATOR the system-SPECIAL attribute can greatly affect the overall security and integrity of your z/VM system.

Note: The RAC SETEVENT REFRESH command must be run on the z/VM system where the user is logged on to take effect. If the user is not logged on, or is logged on to a different member of the SSI cluster, an error message is received, as shown in the following example: RPISET133E SETEVENT FAILED. USER IS NOT CURRENTLY LOGGED ON. To complete the refresh, log on to each system in your cluster and issue the refresh for the users who are logged on to that system. Alternatively, restart the affected servers (which can be done remotely from a central system by running the AT command).

Important: This step must be repeated for each member of an SSI cluster.

Note: Make sure that you run the PUT2PROD EXEC without any parameters because the $SERVICE PROD file on the MAINT710 191 disk already lists the components that must be put into production: SERVICE $PRODS A1 V 80 Trunc=80 0 * * * Top of File * * * 1 SERVP2P RACF 2 SERVP2P CP 3 * * * End of File * * *

HCPRWA RPIBASE0  E1 F 80 3 Blks 10/25/06 Line 118 of ===> SYSSEC , X DISKP=ALLOW,DISKU=DEFER,DISKF=FAIL,DISKW=DEFER,DISKM=ON,X RDRP=ALLOW,RDRU=DEFER,RDRF=FAIL,RDRW=DEFER,RDRM=ON, X NODEP=ALLOW,NODEU=DEFER,NODEF=FAIL,NODEW=DEFER,NODEM=ON,X CMDP=ALLOW,CMDU=DEFER,CMDF=FAIL,CMDW=DEFER,CMDM=ON, X LANP=ALLOW,LANU=DEFER,LANF=FAIL,LANW=DEFER,LANM=ON, X DEFLTP=ALLOW,DEFLTU=DEFER,DEFLTF=FAIL,DEFLTW=DEFER @L2C SPACE 3

HCPRWA RB0L0001 E1 F 80 Trunc=80 Size=137 Line=120 Col=1 Alt=2 ====> 120         SYSSEC , X 121 DISKP=ALLOW,DISKU=FAIL,DISKF=FAIL,DISKW=FAIL,DISKM=ON, X 122 RDRP=ALLOW,RDRU=FAIL,RDRF=FAIL,RDRW=FAIL,RDRM=ON, X 123 NODEP=ALLOW,NODEU=FAIL,NODEF=FAIL,NODEW=FAIL,NODEM=ON, X 124 CMDP=ALLOW,CMDU=FAIL,CMDF=FAIL,CMDW=FAIL,CMDM=ON, X 125 LANP=ALLOW,LANU=FAIL,LANF=FAIL,LANW=FAIL,LANM=ON       X   126                DEFLTP=ALLOW,DEFLTU=DEFER,DEFLTF=FAIL,DEFLTW=DEFER @L2C        SPACE 3

Note: Since z/VM 6.3, the HLASM is no longer required to assemble HCPRWA.

Note: The DirMaint-RACF connector is one of the reasons that you use DirMaint with your RACF environment. Although it is fairly easy to write your own execs to provide a similar function, the connector is a maintained component of DirMaint.

Note: The following VMLINK command is used: VMLINK 7VMDIR10 2C2 (FILEL CONFIGRC * This command made it easy to run COPYFile to copy the file and give it the name CONFIGRC DATADVH A.

Important: This file does not exist on the DIRMAINT user; therefore, specify the file mode on the DirMaint file command. Other DirMaint CONFIGxx DATADVH files are on DIRMAINT’s D disk, so they can be stored using the following command: DIRM FILE CONFIGRC DATADVH A = = D

Note: The values for the universal access and audit properties of the created minidisk resource profile are set in the RACF_RDEFINE_VMMDISK_DEFAULTS parameter in the CONFIGRC DATADVH file. You can also set the default access level that is given to the owner of a disk by using the RACF_DISK_OWNER_ACCESS parameter. Similar parameters exist for the other resource types that are managed by the DirMaint-RACF connector.

Note: IBM provides the DirMaint-RACF connector, which defines RACF profiles whenever a change is made to your directory by using DIRM commands. This process is done if a user is added or deleted, for example, and when adding minidisk definitions to virtual guests. However, the DirMaint-RACF connector creates discrete profiles only, which provides a basic security implementation and makes sure that resources are protected.

Note: Consider the following points: •Valid generic characters are %, *, and **. •Specify % in profile names to match any single non-blank character on the same position of the resource name. •Specify * or ** in the profile name to match more than one single character in the same position of the resource name. For more information, see Chapter 6, “Defining Resources”, in z/VM RACF Security Server Security Administrator’s Guide, SC24-6218.

Note: If you decide to use generic profiles for class VMMDISK, genlist this class. Run the following command: SETROPTS GENLIST(VMMDISK) This command causes one copy of each generic profile for the VMMDISK class to be kept in the RACFVM service machine. Changes that are made to generic minidisk profiles are not reflected until a SETROPTS refresh command is issued, as shown in the following example: SETROPTS GENERIC(VMMDISK) REFRESH

Note: Consider the following points: •VLAN-Id qualified profiles must be discrete; generic profiles are ignored. •Global access checking cannot be used for VLAN ID-qualified profiles.

Note: z/VM 6.4 with RACF and security labels in place was evaluated against the Common Criteria Labeled Security Protection Profile (LSPP). The evaluated configuration received an Evaluation Assurance Level of EAL4+. z/VM V7.1 is designed to comply with the same Common Criteria requirements as were successfully evaluated for z/VM V6.4. For more information about the evaluated configuration, see Secure Configuration Guide for z/VM, SC24-6323.

Note: Implement MAC that uses the RACF SECLABEL class as another security protection over and above standard DAC rather than as a security model in its own right.

Note: Make this kind of backup during a period of as little system activity as possible.

Note: For more information about the recovery procedures for events that can compromise RACF operation and about RACF recovery or for any other specific scenarios, see Chapter 7, “Recovery procedures” of z/VM V7.1 RACF Security Server System Programmer's Guide, SC24-6312.

Note: For SSI, it is required that the RACF database is shared between the members of an SSI cluster. For more information about DASD sharing, see the Sharing RACF Databases in a z/VM Single System Image Cluster section of z/VM: RACF Security Server System Programmer's Guide, SC24-6312, and z/VM: CP Planning and Administration, SC24-6271.