Controlling access to password files

To control access to the protected password files on UNIX and Linux systems, you can log on as an authorized user and set the passwordaccess option to generate.

Complete the following steps when you set the passwordaccess to generate:

1. Write the application with a call to dsmSetUp which passes argv[0]. The argv[0] contains the name of the application that calls the API. The application is permitted to run an authorized user; however, the administrator must decide on the login name for the authorized user.
2. Set the effective user ID bit (S bit) for the application executable to On. The owner of the application executable file can then become an authorized user and can create a password file, update passwords, and run applications. The owner of the application executable file must be the same as the user ID that runs the program. In the following example, User is user1, the name of the application executable file is applA, and user1 has read/write permissions on the /home/user1 directory. The applA executable file has the following permissions:

     -rwsr-xr-x user1    group1   applA

3. Instruct the users of the application to use the authorized user name to log in. IBM® Storage Protect verifies that the login ID matches the application executable owner before it permits access to the protected password file.
4. Set the passworddir option in the dsm.sys file to point to a directory where this user has read/write access.
   For example, enter the following line in the server stanza of the dsm.sys file:

     passworddir /home/user1

5. Create the password file and ensure that the authorized user owns the file.
6. Log on as user1 and run app1A.
7. Call dsmSetUp and pass in argv.