Security Considerations

The Backstore Engine › USS Backstore › Security Considerations

Security Considerations

The user ID assigned to CA Vtape started tasks, normally SVTS and SVTSAS procedure, as well as the batch utilities that require access to USS and must all have a valid OMVS segment. Your security administrator must set up these segments.

To set up an OMVS segment

Choose an OMVS UID number to associate with your user ID. Your security administrator may have a policy for assigning OMVS UID numbers. If not, use a unique number.
Note: For more information about OMVS UID numbers, see IBM’s UNIX System Services Planning guide.
Define the OMVS segment for the user. For a user ID uuuuuuu, UID number nnn, and home directory path_name, enter the following commands:
- For CA ACF2 for z/OS systems, enter the following commands:
```
SET PROFILE(USER) DIV(OMVS)
INSERT uuuuuuu UID(nnn) HOME(path_name) OMVSPGM(/bin/sh)
```
- For CA Top Secret for z/OS systems, enter the following commands:
```
TSS ADD(uuuuuuu) HOME(path_name) OMVSPGM(/bin/sh) UID(nnn)
GROUP(ggggggg)    
```
- For RACF systems, enter the following command:
```
ALU uuuuuuu OMVS(UID(nnn) HOME(path_name) PROGRAM(/bin/sh))
```
Note: The OMVS segment must contain the following:
- A home directory (HOME)
- A login shell (PROGRAM or OMVSPGM)
Complete this process for each user ID that you want to authorize. To confirm the contents of the OMVS segment enter the following commands:
- For CA ACF2 for z/OS systems, enter the following commands:
```
SET PROFILE(USER) DIV(OMVS)
LIST uuuuuu
```
- For CA Top Secret for z/OS systems, enter the following command:
```
TSS LIST(uuuuuu) DATA(ALL) 
```
- For RACF systems, enter the following command:
```
LISTUSER uuuuuu OMVS NORACF
```
Choose a home directory to associate with each user ID, and ensure that it exists and that the UID has read/write access to it. You can use the UNIX directory (path_name) as shown in Step 2, or you can use a customized home directory name.
For example, to set up a directory called /u/users/vtape for UIDnnn, issue the following commands in the OMVS UNIX shell:
```
mkdir /u/users/vtape
chown nnn /u/users/vtape
chmod 775 /u/users/vtape
```
Confirm the owner and access to the directory by using the following command:
```
ls -ld /u/users/vtape
```
The following result appears:
```
drwxrwxr-x   2 user  group  8192 Sep  31 14:58 /u/users/vtape
```