Define security authorization for Policy Agent

Define the appropriate security authorizations for Policy Agent.

Before you begin

You can use RACF for authorizing the necessary components for secure communications. For other security management products, refer to your product documentation.

The following terms appear in this task:

Policy Agent: Policy definition for AT-TLS. For more information, see z/OS Communications Server: IP Configuration Guide:Policy Agent.
PAGENT: Policy Agent started task.
pasearch: z/OS® UNIX® System Services command used to query information from Policy Agent, such as displaying policy definitions.
syslogd: The z/OS UNIX System Services syslog daemon. The TCP/IP documentation recommends writing Policy Agent messages to the z/OS UNIX syslog instead of using the default log file. AT-TLS always writes messages to the z/OS UNIX syslog.

Related information

z/OS Communications Server: IP Configuration Guide: Steps for configuring the Policy Agent
z/OS Communications Server: IP Configuration Guide: TCP/IP stack initialization access control

About this task

You must define the RACF authorization for Policy Agent started task (PAGENT) and pasearch commands. The steps in this procedure include providing the following protections:

INITSTACK protection: Policy Agent is started after TCP/IP is initialized. This means that there is a (small) window where applications can use the TCP/IP stack without the TTLS policy being enforced. Define the EZB.INITSTACK.** profile in the SERVAUTH class to prevent access to the stack during this time window, except for applications with READ access to the profile. You must permit a limited set of administrative applications to the profile to ensure full initialization of the stack, as documented in z/OS Communications Server: IP Configuration Guide: TCP/IP stack initialization access control.
pasearch protection: Define profile EZB.PAGENT.** in the SERVAUTH class to restrict access to the pasearch command.

The following procedure provides example RACF commands to perform these steps.

Note: The examples are intended as a guide; you can organize your security definitions differently, depending on the requirements of your site.

Procedure

Complete the following steps to set up security definitions for Policy Agent in RACF.

Define the RACF authorization for the PAGENT started task and pasearch command.
In this example, Policy Agent runs as a z/OS started task named PAGENT. To define the Policy Agent started task to RACF, use the RDEFINE command to create the PAGENT.* profile in the STARTED class. (The SETROPTS commands are included for completeness. These commands have no effect when the STARTED class is already activated.)
```
SETROPTS CLASSACT(STARTED)
SETROPTS RACLIST(STARTED)
SETROPTS GENERIC(STARTED)
RDEFINE STARTED PAGENT.*
RDEFINE STARTED SYSLOGD.*
```

Define the PAGENT user ID.

In this example, Policy Agent runs under the z/OS user ID named PAGENT and has a default group (DFLTGRP) of OMVS and an OMVS segment with a UID of 0.

ADDUSER PAGENT NAME('user-name') DFLTGRP(OMVS)
ALTUSER PAGENT OMVS(UID(0),HOME(/u),PROGRAM(/bin/sh))
RALTER STARTED PAGENT.* STDATA(USER(PAGENT))
RALTER STARTED PAGENT.* STDATA(USER(SYSLOGD))

Refresh the in-storage generic profiles.

SETROPTS RACLIST(STARTED) REFRESH
SETROPTS GENERIC(STARTED) REFRESH

Grant Policy Agent the ability to make socket requests during TCP/IP stack initialization.
A TCP/IP stack initializes before Policy Agent installs policies into the stack. During the initialization window, only user IDs that are permitted to the EZB.INITSTACK.sysname.tcpname profile in the SERVAUTH class can make socket requests.
```
SETROPTS CLASSACT(SERVAUTH)
SETROPTS RACLIST(SERVAUTH)
RDEFINE SERVAUTH EZB.PAGENT.sysname.tcpname.* UACC(READ)
RDEFINE SERVAUTH EZB.INITSTACK.sysname.tcpname.* UACC(READ)
SETROPTS GENERIC(SERVAUTH) REFRESH
SETROPTS RACLIST(SERVAUTH) REFRESH
```
Where sysname is the system name (for example, TVT5011), and tcpname is the TCP/IP job name (for example, TCPIP).