The Virtualization Cookbook for SLES 10 SP2 - z/VM - IBM

4.8.2 Testing the changes
To test your changes you must reIPL z/VM again. Be sure you are in a position to do so!
Perform the following steps:
► Shutdown and reIPL your system.
==> shutdown reipl iplparms cons=sysc
SYSTEM SHUTDOWN STARTED
► When your system comes back logon as MAINT.
► Query the SRM values to see that the new STORBUF settings is in effect and the SIGNAL
SHUTDOWN value is set to 300 seconds:
==> q srm
IABIAS : INTENSITY=90%; DURATION=2
LDUBUF : Q1=100% Q2=75% Q3=60%
STORBUF: Q1=300% Q2=250% Q3=200%
DSPBUF : Q1=32767 Q2=32767 Q3=32767
...
==> q signal shutdown
System default shutdown signal timeout: 300 seconds
This output shows that your changes have taken effect.
4.9 Addressing z/VM security issues
This section briefly discusses the following security issues.
► z/VM security products
► High level z/VM security
► Linux user ID privilege classes
► z/VM user ID and minidisk passwords
VM security products
You might want to use a z/VM security product such as IBM RACF or CA VM:Secure. They
allow you to address more security issues such as password aging and the auditing of users
access attempts.
High level z/VM security
The paper z/VM Security and Integrity discusses the isolation and integrity of virtual servers
under z/VM. It is on the Web at:
http://www.vm.ibm.com/library/zvmsecint.pdf
Linux user ID privilege classes
Another security issue is the privilege class that Linux user IDs are assigned. The IBM
Redpaper Running Linux Guests with less than CP Class G Privilege addresses this issue. It
is on the Web at:
http://www.redbooks.ibm.com/redpapers/pdfs/redp3870.pdf
z/VM user ID and minidisk passwords
All passwords in a vanilla z/VM system are the same as the user ID. This is a large security
hole. The minimum you should do is to address this issue.
There are two types of passwords in the USER DIRECT file:
62 The Virtualization Cookbook for RHEL 6