Open topic with navigation

ibi™ Open Data Hub for Mainframe Connectors 1.0.8

# Security Providers for UNIX/Linux

The default security provider for a new installation is the internal security provider, PTH. The PTH provider implements security using user IDs, passwords, and group memberships stored in the `admin.cfg` configuration file.

After the initial installation, the Server Administrator that was configured during the installation can start the server and use the Reporting Server browser interface to further customize security settings, for example, to configure alternate or additional security providers, create additional PTH IDs, and register groups and users in a security role. For more information about security providers, see the Server Security chapter in the ibi™ WebFOCUS® Reporting Server Administration guide.

## Satisfy Security Provider OPSYS Requirements

To run a server in security provider OPSYS mode in UNIX/Linux, you must perform the following steps. Do this once after installing and after each refresh of the server with fixes.

Set up `tscom300.out` as a root-owned SUID program:

Procedure
1. If the server is running, bring it down.
2. Log in to the system as root, or issue the su root command.
3. Change your current directory to the bin directory of the home directory created during the installation procedure.

   For example, type the following command:

       cd /home/iadmin/ibi/srv93/home/bin

4. Change file ownership and permissions by typing the following commands:

       chown root tscom300.out
       chmod 4555 tscom300.out

5. Verify your changes by issuing the following command:

       ls -l tscom300.out

   The output should be similar to the following:

       -r-sr-xr-x 1 root iadmin 123503 Aug 23 04:45 tscom300.out

   Note the permissions and ownerships.

Result

When you start the server, it runs with security provider OPSYS.

The chmod and chown steps will need to be repeated after any server upgrade since the tscom300.out file is replaced during an upgrade and the attributes are lost.

Note:

If this Security Provider OPSYS step has been done and the site later decides to switch to Security OFF, special steps must be taken to ensure that the mode remains after a full server shutdown (where edastart -start is used to restart the server). The steps are:

1. After the server recycles from the change to OFF, use the Reporting Server browser interface to open the environment configuration file of the server by clicking Workspace and expanding the Configuration Files folder, followed by the Miscellaneous folder.
2. Double-click Environment - edaenv.cfg to edit the file and add the EDAEXTSEC=OFF variable.
3. Save your work.

After the next full server shutdown, be sure to do an `edastart -cleardir` before restarting the server. This clears any root-owned files that would prevent a security OFF server from starting.

## Preventing Unsecured Server Starts After Upgrades

If the explicit environment variable EDAEXTSEC is set to OPSYS (or ON) and the server cannot impersonate users because it lacks platform-specific authorization steps, the server start-up is canceled and error messages are written to the edaprint log.

This feature prevents an unsecured start of the server after a software upgrade if any of the required post-upgrade, reauthorization steps are missed on a UNIX/Linux, IBM i, or z/OS HFS deployment. This is not applicable to other platforms. The setting may be placed in any normal server start-up shell or profile that a site is using or in the server edaenv.cfg environment configuration file. The messages vary slightly by platform.

The edaprint messages are:

    Configured security is 'ON' as set by EDAEXTSEC variable.

    Server has no root privilege.

    Workspace initialization aborted.

    (EDA13171) UNABLE TO START SERVER

Did you find this helpful?

Yes No
Great!
Thanks for taking the time to give us some feedback.
Sorry about that

Why wasn't this helpful? (check all that apply)

Could not find what I was looking for
Instructions confusing or unclear
Instructions did not work

Want to tell us more?

Please select at least one option or provide details about the issue!!

Error occurred while submitting feedback.

Error2 occurred while submitting feedback.

ibi™ Open Data Hub for Mainframe Connectors

Copyright © 2021-2025. Cloud Software Group, Inc. All Rights Reserved.