TCP/IP Security

The process to establish a proper security connection is:

Define TCP/IP to CA Top Secret by adding a facility definition for TCP/IP to the Facility Matrix Table.
For example, rename a USERxx entry:
```
FAC(USER11=NAME=TCP)
FAC(TCP=PGM=xxx)
FAC(TCP=NOTSOC,RES,NOIJU,AUTHINIT)
```
Depending on the release of TCP/IP used, the program name (xxx) is:

TCP/IP 3.1 PGM=MVP

TCP/IP 3.2 PGM=EZA

TCP/IP 3.4 PGM=EZB

Set all other FACILITY parameters according to your site‑specific needs.

Note: If the RES attribute is omitted from the FACILITY definition, no user or profile data set rules are loaded into the TCP address space.

Create a Region ACID.

For example:

TSS CRE(TCP) NAME('TCPIP/FTP
             REGION ACID')
             FAC(BATCH,STC)
             PASS(password,0)
             DEPT(DEPT)
             MASTFAC(TCP)
             NOVOLCHK 
             NODSNCHK
             NOLCFCHK
             NORESCHK
             NOSUBCHK

TSS ADD(TCP) UID(0)
             GROUP(OMVSGRP)
             DFLTGRP(OMVSGRP)
             HOME(/)
             OMVSPGM (/bin/sh)

The Region ACID must have:

The NODSNCHK attribute or a permit for DSN(*****) ACC(ALL).
The NOSUBCHK attribute. If this attribute is omitted, DRC157 errors on submit of batch jobs from the TCP address space occur.

To properly secure job submission, the JES facility must be in FAIL MODE.

Define the TCP procedure to the CA Top Secret STC Record.
For example:
```
TSS ADD(STC) PROCNAME(TCPPROC)
             ACID(TCP)
```