Your browser does not allow storing cookies. We recommend enabling them.

SSH

Permission Requirements

The following permissions are required for installing and running Tectia Server for IBM z/OS:

File system requirements

Write access to the /opt directory is required during the installation.

User account requirements for installing the server
  • The setup script uses the extattr command to make the server program, /opt/tectia/sbin/sshd2, program-controlled. To issue the command, the user account running the setup must have read access to the BPX.FILEATTR.PROGCTL facility.

  • The user account running the setup must have an OMVS segment and the UID 0.

User account requirements for running the server

It is recommended that a user account, SSHD2, is created for running Tectia Server for IBM z/OS, see Creating the SSHD2 User:

  • The user account running the server must have an OMVS segment and the UID 0.

  • If the BPX.DAEMON FACILITY class profile is defined, the user must have read access to it.

Requirements for user accounts to support access via Tectia Server
  • Required: An OMVS segment

  • Optional: A home directory. It is required if public key user authentication is used or if the account requires user-specific configuration, for example, environment variables for the file transfer subsystem.

Requirements for user accounts that run Tectia client programs
  • Required: An OMVS segment

  • Optional: A home directory. It is required if public key user authentication is used or if the account requires user-specific configuration, for example, profiles for remote hosts.

Library requirements
  • CEE.SCEERUN and CEE.SCEERUN2 libraries must be available in LPALIB or LNKLST.

  • CEE.SCEERUN2 must be program-controlled.

TCP permissions

The server must be allowed to listen to port 22 (or other configured Secure Shell port).

Permissions for storing keys in SAF

If the server host key or the user keys are going to be stored in the System Authorization Facility (SAF), additional permissions are required. See Using the z/OS System Authorization Facility for more information.


 

 
Highlights from the SSH.COM blog:

  • Cryptomining with the SSH protocol: what big enterprises need to know about it

    Cryptomining malware is primarily thought of as targeting desktops and laptops and is used to hijack system resources to mine cryptocurrency.
    Read more
  • SLAM the door shut on traditional privileged access management

    Did you know that something as trivial-sounding as granting access for your developers or third parties to a product development environment can throw a gorilla-sized monkey wrench into your operations and productivity?
    Read more
  • We broke the IT security perimeter

    Everyone understands the concept of a security perimeter. You only gain access if you are identified and authorized to do so.
    Read more