[Contents] [Index]

About This Document >>     Installing SSH Tectia Server for IBM z/OS >>         Preparing for Installation >>             System Requirements             Permission Requirements             Directories and Datasets             Upgrading Previously Installed Secure Shell Software         Installing the SSH Tectia Server for IBM z/OS Software >>     Getting Started with SSH Tectia Server for IBM z/OS >>     Setting up Non-Interactive Server and User Authentication >>     Setting up Non-Interactive Secure File Transfer >>

Permission Requirements

The following permissions are required for installing and running SSH Tectia Server for IBM z/OS:

• File system requirements

  Write access to the /opt directory is required during the installation.

• User account requirements for installing the server
  • The setup script uses the extattr command to make the server program, /opt/tectia/sbin/sshd2, program-controlled. To issue the command, the user account running the setup must have read access to the BPX.FILEATTR.PROGCTL facility.
  • The user account running the setup must have an OMVS segment and the UID 0.

• User account requirements for running the server

  It is recommended that a user account, SSHD2, is created for running SSH Tectia Server for IBM z/OS, see Section Creating the SSHD2 User:

  • The user account running the server must have an OMVS segment and the UID 0.
  • If the BPX.DAEMON FACILITY class profile is defined, the user must have read access to it.

• User account requirements for using SSH Tectia client programs
  • Required: An OMVS segment
  • Optional: A home directory, needed only for storing host keys or public keys

• Library requirements
  • CEE.SCEERUN and CEE.SCEERUN2 libraries must be available in LPALIB or LNKLST.
  • CEE.SCEERUN2 must be program-controlled.

• TCP permissions

  The server must be allowed to listen to port 22 (or other configured Secure Shell port).

• Permissions for storing keys in SAF

  If the server host key or the user keys are going to be stored in the System Authorization Facility (SAF), additional permissions are required.