CICS Transaction Gateway V5 The WebSphere ... - IBM Redbooks

Basic CICS TG configuration
The commands listed in the following sections are in addition to the basic
configuration necessary for normal functioning of the CICS TG for z/OS. Before
you implement any security in your environment, we recommend that you set up
and test a non-secure environment as documented in Chapter 4, “EXCI
connections to CICS” on page 65 and Chapter 7, “TCP connections to the
Gateway daemon on z/OS” on page 133. In this chapter, you will find
documented the following actions, which are necessary for the normal
functioning of the CICS TG in a non-secure environment:
► Setup of the started task user ID
► Access to the TCPIP.STANDARD.TCPXLBIN data set
► Removal of the share bit (s extended attribute) from the ctgstart script
► Access to the BPX.SERVER profile
► Enabling of program control for CICS TG data sets and HFS files
We now document the following steps necessary to secure access to our CICS
program EC01:
► Configure MRO bind time security
► Enable CICS TG password checking
► Configure security for CICS CONNECTION and SESSIONS definitions
► Configure the flowed user ID
► Permit access to the mirror transaction, CSMI
► Define RACF surrogate profiles
104 CICS Transaction Gateway V5
Note: We used security prefixing (SECPRFX=YES) in our CICS region, which
prevents our RACF security profiles from affecting other CICS regions. This
can be quite useful in a production environment, since it means all security
profiles are unique to an individual region, but conversely it can mean more
work for the security administrator because more profiles must be defined.
Tip: We encountered problems when running a transactional EXCI request
(using EciI1) with security enabled on the CICS TG. Each time we ran a
request we would see dirty address space errors when attempting to access
module DFHXCSVC in the SDHFLINK library. Marking
CICSTS22.CICS.SDFHLINK as program controlled solved this problem.
MRO bind security (DFHAPPL FACILITY class profiles)
MRO bind security prevents unauthorized attached MRO regions from starting
transactions in a CICS region, and as such applies equally to the CICS TG, as a
user of MRO, as it does to CICS. It is implemented using two different DFHAPPL
FACILITY class profiles that control logon to IRP. To log on to IRP, the user ID
under which the CICS TG runs requires the following permissions: