Set up CA WA CA 7 Edition Security Rules

CA WA CA 7 Edition Environment › Configuration for CA IAS and CA WA CA 7 Edition › CA 7 Online System Modifications › Set up CA WA CA 7 Edition Security Rules

Set up CA WA CA 7 Edition Security Rules

Security rules are required for setting up access to the commands supporting the agent jobs. The commands protected by security include the following:

/AFM command (used by the user interface): L2SCAFM
/AGENT command: L2SCAGNT
/DELAGNT command: L2SCDELA
/IAS command: L2SCIAS
AGFILE command: L2AGX
AGPSWD command: L2DBAPSW
JOBSTART command (used by SAP jobs with STARTMODE=N): L2QPSTRT
LAGENT command: L2GILAGT
REPLY command (used by i5/OS jobs): L2QPREPL

In addition to these checks, external security checks can be made for the following when the initialization SECURITY statement is coded to make these calls. Put in place appropriate rules to control the following resources:

For job submission:
```
CA7-instance.AGENTUSR.userid.agentname
```

For commands:

CA7-instance.AGENTMSG.verbsubverb.agentname

Where userid is the distributed operating environment user ID, agentname is the name of the agent to which the job or command is being submitted, and the verbsubverb is the command being issued. The verbs and subverbs you may want to secure include the following; not all verb/subverbs are applicable to all agents; many depend on the job type, operating environment, or both.

Verb	Subverb	Function
CONTROL	CANCEL	Cancel a job on an agent
CONTROL	CLRFILES	Clear the log files on an agent
CONTROL	EXPEDITE	Increase the priority of a job on an agent
CONTROL	GETLOGFILE
CONTROL	GETSPOOLFILE	Retrieve spool file for a job
CONTROL	GETSPOOLFILELIST	Retrieve list of spool files (i5/OS)
CONTROL	GETRACEFILE
CONTROL	REFRESH	Refresh the agent security rules
CONTROL	SETPROPERTY	Set a property in agentparm.txt
CONTROL	SHUTDOWN	Shut down the agent
CONTROL	STATUS	Ping an agent
DBMON	DELETE	Cancel a DB monitor job
DBTRIG	DELETE	Cancel a DB trigger job
FILETRIG	DELETE	Cancel a file trigger job
PSCMD	GETLOGFILE
REPLY	. (period)	Reply to the i5/OS message
RUN	OACMD	Hold or cancel an Oracle job
RUN	PSCMD	Hold or cancel a PeopleSoft job
RUN	RFCR3CMD	Execute an SAP command
SQLCMD	CANCEL	Cancel a DB SQL job

Where there is a period (.), the period must be part of the rule, as it is a valid subverb.

Note: For more information, see the CA WA CA 7 Edition Security Reference Guide.