The SSHD2 user is used to run the Tectia Server and Certificate Validator. SSHD2 must have an OMVS segment and the UID 0. Further, if the BPX.DAEMON FACILITY class profile is defined, the user must have read access to it.

	Caution
	The SSHD2 user must not have SURROGATE rights. With those rights, the user could log in using an empty password, which is not desirable.

To create the SSHD2 user, use commands such as those in the ADDSSHD2 example located in the opt/tectia/doc/zOS/SAMPLIB directory (shown below).

ADDSSHD2:

//ADDSSHD2 EXEC PGM=IKJEFT1A,DYNAMNBR=75,TIME=100,REGION=0M
//SYSPRINT DD  SYSOUT=*
//SYSTSPRT DD  SYSOUT=*
//SYSTERM  DD  DUMMY
//SYSTSIN  DD *
  ADDUSER SSHD2 +
    NAME('User SSHD2 for running SSH Tectia server') +
    OWNER(IBMUSER) +
    NOPASSWORD NOOIDCARD +
    OMVS(PROGRAM('/bin/false') UID(0) SHARED)
  PERMIT   BPX.DAEMON CLASS(FACILITY) ID(SSHD2) ACCESS(READ)
  SETROPTS REFRESH    RACLIST(FACILITY)
/*