z/OS UNIX System Services › Controlling Access to USS › Password Prompts

Password Prompts

Several created started task ACID definitions specify a password. Started task ACIDs with passwords cause a password prompt at console startup. Prompting is optional and can be turned off using control option setting OPTIONS(4).

The OPTIONS control option must be set via the CA Top Secret parameter file. It cannot be set with a MODIFY command.

Define the OMVS Started Task ACID for Using CA Top Secret in USS

To use CA Top Secret in a USS environment, you must assign an ACID to USS to use for the OMVS started task.

Follow these steps:

1. Create group ACIDS to which to attach the started task ACID:

   TSS CREATE(OMVSGRP)	TYPE(GROUP)
                       	NAME(‘OMVS GROUP’)
                       	DEPT(OMVSDEPT)
   TSS CREATE(TTY)		TYPE(GROUP)
                   		NAME(‘REQ OMVS TTY GROUP’)
                   		DEPT(OMVSDEPT)
   

2. Assign GIDs to the group ACIDs:

   TSS ADD(OMVSGRP) GID(1)
   TSS ADD(TTY) GID(2)
   

   The product assigns GID 1 to the OMVSGRP group and assigns GID 2 to the TTY group.

3. Create the ACID to use for the OMVS started task:

   TSS CREATE(OMVSKERN) TYPE(USER)
                        NAME(‘OMVS STC ACID’)
                        PASS(password,0)
                        DEPT(dept)
                        FACILITY(STC)
   

4. Define the OMVS started task to the STC record:

   TSS ADD(STC) PROCNAME(OMVS)
                ACID(OMVSKERN)
   

5. Issue the following command to assign superuser status, assign a default group, and assign the OMVSGRP and TTY groups to the OMVS started task ACID:

   TSS ADD(OMVSKERN) UID(0)
   

   			 DFLTGRP(OMVSGRP)
   

   			 GROUP(OMVSGRP)
   			 GROUP(TTY) 
   

6. Define a BPXROOT ACID:

   TSS CREATE(BPXROOT) TYPE(USER)
                       NAME(‘BPXROOT ACID’)
                       PASS(password,0)
                       DEPT(OMVSDEPT)                   
   TSS ADD(BPXROOT) GROUP(OMVSGRP)
                    DFLTGRP(OMVSGRP)
                    UID(0)
   

   Defining this ACID ensures that the system can function properly if the SUPERUSER parameter is not defined in SYS1.PARMLIB member BPXPRMxx. If SUPERUSER has no assigned value, the default is BPXROOT.

   Important! Your defined BPXROOT ACID must be defined with UID(0) and must not have BPX.DAEMON authorization.

   You have defined the OMVS started task ACID.