Defining Security Protection Profiles in CA ACF2 › Utility Protection Profiles for CA ACF2 › Defining System Specific Utility Protection Profiles for CA ACF2

Defining System Specific Utility Protection Profiles for CA ACF2

This command has the following format:

$KEY(BESn.UTILITY.utility_name) TYPE(BES) 
$OWNER(ownerid)    
  UID(userid) ALLOW
  UID(userid) PREVENT

$KEY(

Specifies the definition of a CA ACF2 key set.

BES

Specifies this is a CA Tape Encryption resource. This is always BES.

n

Indicates the local BES subsystem number (1-8). You should create this rule set for each BES subsystem as necessary.

UTILITY

Specifies this is a CA Tape Encryption utility resource. This is always UTILITY.

utility_name

Indicates one of the eligible CA Tape Encryption utilities. Options for this parameter are as follows:

TBESHOW

Specifies the BES database listing utility.

TBEKMUTL

Specifies the BES key maintenance utility.

$OWNER(ownerid)

Specifies the owner of the rule. You can specify up to 24 characters in the $OWNER control statement. CA ACF2 provides the $OWNER statement in case you want to track ownership of a rule.

UID(userid) ALLOW

Rule set to allow the specified userid access to the encryption key.

UID(userid) PREVENT

Rule set explicitly prevent the userid from gaining access and being able to use the encryption key.

Example: CA ACF2 utility protection key set for TBESHOW

Note: You need to define a unique key set for each individual BESn subsystem.

$KEY(BES2.UTILITY.TBESHOW) TYPE(BES)
$OWNER(BES)
  UID(SYS-)  ALLOW
  UID(OPER-) PREVENT

Example: CA ACF2 utility protection key set for TBEKMUTL

Note: You need to define a unique key set for each individual BESn subsystem.

$KEY(BES8.UTILITY.TBEKMUTL) TYPE(BES)
$OWNER(BES)
  UID(SYS-)  ALLOW
  UID(OPER-) PREVENT

Example: Granting CA Vantage access to TBESHOW

Note: You need to define a unique key set for each individual BESn subsystem.

$KEY(BES8.UTILITY.TBESHOW) TYPE(BES)
$OWNER(BES)
  UID(VANID)  ALLOW