Red Hat SATELLITE 5.1.0 RELEASE NOTES Instrukcja Instalacji Pobierz pdf (Strona 79)

Chapter 4. Installing and configuring z/VM 61

4.9.1 VM security products

You might want to use a z/VM security product such as IBM RACF® or CA VM:Secure. They

allow you to address more security issues such as password aging and the auditing of user

access attempts.

4.9.2 High level z/VM security

The paper z/VM Security and Integrity discusses the isolation and integrity of virtual servers

under z/VM. It is available on the Web at:

http://www-1.ibm.com/servers/eserver/zseries/library/techpapers/pdf/gm130145.pdf

Linux user ID privilege classes

Another security issue is the privilege class that Linux user IDs are assigned. The IBM

Redpaper publication Running Linux Guests with less than CP Class G Privilege addresses

this issue. It is on the Web at:

http://www.redbooks.ibm.com/redpapers/pdfs/redp3870.pdf

z/VM user ID and minidisk passwords

All passwords in a “vanilla” z/VM system are the same as the user ID. This is a large security

hole. The

minimum you should do is to address this issue.

There are two types of passwords in the USER DIRECT file:

User IDs The password required to logon with

Minidisks Separate passwords for read access, write access and multi-write access

Both types of passwords should be modified. This can be done using the CHPW540 XEDIT

macro defined in the next section.

4.9.3 Changing passwords in USER DIRECT

Changing the passwords can be done manually in XEDIT. However, this is both tedious and

error-prone. So a profile named CHPW540 XEDIT has been included with this book. The source

code is in “The CHPW540 XEDIT macro” on page 220.

This macro will change all z/VM passwords to the same value, which may still not be

adequate security, given the different function of the various user IDs. If you want different

passwords, you have to modify the USER DIRECT file manually, either with or without using the

CHPW52 XEDIT macro.

To modify all user ID and minidisk passwords to the same value, perform the following steps.

1. Logon to MAINT.

2. Link and access the LNXMAINT 192 disk to pick up the CHPW540 XEDIT macro:

==> vmlink lnxmaint 192

DMSVML2060I LNXMAINT 192 linked as 0120 file mode Z

3. Make a backup copy of the USER DIRECT file and first be sure the password that you want to

use is not a string in the file. For example, if you want to change all passwords to lnx4vm,

then do the following:

==> copy user direct c = direwrks = (oldd

==> x user direct c

====> /lnx4vm

1 2 ... 74 75 76 77 78 79 80 81 82 83 84 ... 267 268

Brak uwag

Red Hat SATELLITE 5.1.0 RELEASE NOTES Instrukcja Instalacji Strona 79