Your browser does not allow storing cookies. We recommend enabling them.


Permission Requirements

Before Installation

Before you start installing Tectia Server for IBM z/OS, make sure the following requirements are met:

File system requirements

Write access to the /opt directory is required during the installation.

User account requirements for installing the server
  • The user account installing the product must have an OMVS segment, UID 0 and RACF SPECIAL privilege.

User account requirements for running the server
  • The user account running the server must have an OMVS segment and the UID 0.

  • If the BPX.DAEMON FACILITY class profile is defined, the user must have read access to it.

Requirements for user accounts to support access via Tectia Server
  • Required: An OMVS segment

    Users who are to have access to in-bound SFTP or SSH require an OMVS segment defined in their profile. If a shell program is specified, it must be the pathname of an executable z/OS UNIX shell program; if omitted, the default shell program defined in z/OS UNIX customization is used.

  • Optional: A home directory. It is required if public key user authentication is used or if the account requires user-specific configuration, for example, environment variables for the file transfer subsystem.

Requirements for user accounts that run Tectia client programs
  • Required: An OMVS segment

  • Optional: A home directory. It is required if public key user authentication is used or if the account requires user-specific configuration, for example, profiles for remote hosts.

Library requirements
  • The Tectia SSH Assistant application requires the Rexx runtime or Rexx alternate libraries to execute. The Rexx Alternate Library SEAGALT (for example, FAN140.SEAGALT or IBM.REXX.SEAGALT, etc.), which is shipped as part of z/OS since version 1.9, may be used to satisfy this requirement. SEAGALT must be available in the linklist or in a STEPLIB allocated to your TSO session.

Permissions for storing keys in SAF

If the server host key or the user keys are going to be stored in the System Authorization Facility (SAF), additional permissions are required.

During Installation

The following additional requirements will be handled during the installation with Tectia SSH Assistant:

  • The Tectia SSH Assistant ISPF application uses the extattr command to make the server program, /opt/tectia/sbin/sshd2, program-controlled. To issue the command, the user account running the setup must have read access to the BPX.FILEATTR.PROGCTL facility.

  • It is recommended that a user account, SSHD2, is created for running Tectia Server for IBM z/OS.

  • CEE.SCEERUN and CEE.SCEERUN2 libraries must be available in LPALIB or LNKLST, and CEE.SCEERUN2 must be program-controlled.

  • The server must be allowed to listen to port 22 (or other configured Secure Shell port).




What to read next:

  • Reduce Secure Shell risk. Get to know the NIST 7966.

    The NISTIR 7966 guideline from the Computer Security Division of NIST is a direct call to action for organizations regardless of industry and is a mandate for the US Federal government.
    Download now
  • ISACA Practitioner Guide for SSH

    With contributions from practitioners, specialists and SSH.COM experts, the ISACA “SSH: Practitioner Considerations” guide is vital best practice from the compliance and audit community.
    Download now