Install and configure the RPM or DEB

<login to host>
cd /root/

rpm -i <rpm_name>   /* for RPM */           
dpkg -i <deb_name>  /* for DEB */

If all users that use the CCA logout and then login again, and if all applications that use CCA are re-started, then a reboot may be avoided. It is always recommended to reboot to ensure for new users or new system administrators that the updated profiles are actually in force after the install procedure is completed.

<login as root to host>
	cd /opt/IBM/CCA/bin/

There are several methods available to load the master keys, and it is important to choose the correct method for your production environment. For more information, see CCA Master Key administration: choosing the right method or tool.

If you want to use the TKE instead of the panel.exe utility, refer to the z/OS Cryptographic Services for proper use and also refer to TKE catcher configuration for a TLS connection. After completing this step using the TKE procedure, go to Step 9.

1. Setup the groups for the users who will be loading the master keys to the cards. Each part of the load process is owned by a different Linux group created by the RPM or DEB install procedure, and verified in the host library implementing the API allowing master key processing. To complete a specific step the user must have membership in the proper group. There are a couple ways to change group membership depending on your Linux distribution. A third option is to create the users specifically for these roles.

   If a user does not have the proper group membership for a particular master key operation, the error X'0008005a' is returned and an error message is printed to the system log.

   Note: To be able to use /opt/IBM/CCA/panel.exe, the user must be either root or a member of the cca_admin group, that is, the owner of

   
   /usr/lib64/libcsulccamk.so /* for RPM */
   /usr/lib/libcsulccamk.so   /* for DEB */

   1. Group membership for Red Hat and Ubuntu based Linux distributions:
      1. Use the groups command to see a list of the user's current group membership:

         groups <user name>
         				---output is
         					<user name> : <grouplist>
         					<grouplist> is a single-space separated list

      2. <grouplist> must be passed along with the new group to the usermod command as a comma-separated list, followed by the <user name>. For example, if you wanted to add cca_lfmkp membership to user named admin, you would use the following commands:

         groups admin
         				---output:
         					admin : admin bin daemon sys wheel
         				usermod -G admin,bin,daemon,sys,wheel,cca_lfmkp admin
         				---output:
         					[none if successful]

         Note: Ensure the user logs out and logs back in, otherwise the group membership in the active session will not be updated.
   2. Group membership for SUSE-based Linux distributions:
      Use the usermod command to add membership for a specific group for a specific user. For example, if you wanted to add cca_lfmkp membership to user admin, you would use the following commands:

      usermod -A cca_lfmkp admin

      Note: Ensure the user logs out and logs back in, otherwise the group membership in the active session will not be updated.
   3. Create users for each role with correct group memberships (Same commands for Red Hat, SUSE, and Ubuntu):
      1. Create user cca_user, which will own default key storage by issuing the following commands:

         1. useradd -g cca_admin -d /home/cca_user -m cca_user

            This command creates the user with primary group cca_admin and a new home directory.

         2. passwd cca_user

            This command sets the new user's password.
      2. Create user cca_lfmkp by issuing the following commands:

         1. 
            useradd -g cca_admin -d /home/cca_lfmkp 
                    -G cca_admin,cca_lfmkp -m cca_lfmkp

            This command creates the user with primary group cca_admin, secondary group cca_lfmkp, and a new home directory.

         2. passwd cca_lfmkp

            This command sets the new user's password.
      3. Create user cca_cmkp by issuing the following commands:

         1. 
            useradd -g cca_admin -d /home/cca_cmkp 
                    -G cca_admin,cca_cmkp -m cca_cmkp

            This command creates the user with primary group cca_admin, secondary group cca_cmkp, and a new home directory.

         2. passwd cca_cmkp

            This command sets the new user's password.
      4. Create user cca_clrmk by issuing the following commands:

         1. 
            useradd -g cca_admin -d /home/cca_clrmk 
                    -G cca_admin,cca_clrmk -m cca_clrmk

            This command creates the user with primary group cca_admin, secondary group cca_clrmk, and a new home directory.

         2. passwd cca_clrmk

            This command sets the new user's password.
      5. Create user cca_setmk by issuing the following commands:

         1. useradd -g cca_admin -d /home/cca_setmk 
                             -G cca_admin,cca_setmk -m cca_setmk

            This command creates the user with primary group cca_admin, secondary group cca_setmk, and a new home directory.

         2. passwd cca_setmk

            This command sets the new user's password.
2. Add group membership privileges to users based on their required function.

   Table 1. CCA groups

   CCA groups

   Group Name	Description
   cca_admin	All users who will run part of the master key load process must be in this group because the library itself is owned by root.cca_admin, with no permissions for 'world' as a protective measure. Reasons for this separate group also include allowing one owner of /usr/lib64/libcsulccamk.so and of /usr/lib/libcsulccamk.so for DEB, and allowing use of panel.exe without allowing any of the master key processing calls.
   cca_lfmkp	The user to LOAD the first key part must be in this group.
   cca_cmkp	The users to LOAD the middle and last key parts must be in this group.
   cca_clrmk	The new master-key register can be CLEARed using the same Master Key Process call in case a mistake was made entering a key part (use the key verification patterns to check for this). To perform the clear, the user must be a member of this group.
   cca_setmk	The user to call SET after the last key part has been successfully loaded must be a member of this Linux group.

3. Load FIRST, MIDDLE (optional), and LAST key parts for the AES, SYM, ASYM, and APKA master keys and then call SET for each master key. This step can be done using the panel.exe utility provided or by writing your own application to call the Master Key Process (CSNBMKP) verb directly. The application must link with the correct library (installed to /usr/lib64/libcsulccamk.so by RPM and to /usr/lib/libcsulccamk.so by DEB), and must be executed at each step by a user with the appropriate group memberships. The utility supports scripted as well as prompt-driven access.

   Repeat this step for each configured adapter. See Changing the master key for two or more adapters that have the same master key, with shared CCA key storage.

   For details about panel.exe, see The panel.exe utility.

   See Master Key Process (CSNBMKP) about parity requirements for master key parts.

   Note: Loading master key parts modifies state information inside the card. For example you cannot load a 'FIRST' master key part twice in a row without clearing the new master-key register in between attempts. The same goes for setting the 'LAST' register. Any number of 'MIDDLE' parts can be loaded - with each call changing the contents of the new master-key register. Similarly a 'SET' operation changes the state of the 'new' register back to 'empty', while updating the 'current' register.