Skip to content

Commit

Permalink
addressing PR feedback
Browse files Browse the repository at this point in the history
Signed-off-by: anaxceron <[email protected]>
  • Loading branch information
anaxceron committed Feb 21, 2024
1 parent d844ae4 commit 506bfa6
Show file tree
Hide file tree
Showing 10 changed files with 32 additions and 44 deletions.
4 changes: 2 additions & 2 deletions docs/user-guide/cli-configure-daemon-on-zlinux-os.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,8 +37,8 @@ To install and build the daemon binary on z/Linux systems:
After the command completes successfully, the Zowe daemon binary is a file named `zowe` that can be found in the `target/release` directory.
7. Copy the binary to another location on the system and add that location **[is "that location" correct?]** to your PATH.
8. To allow others to use the same binary, modify the file permissions: **[where is this modification made? The binary?]**
7. Copy the binary to another location on the system and add that location to your PATH.
8. To allow others to use the same binary, modify the file permissions in the binary:
```
chmod <permission OCTAL> zowe
Expand Down
8 changes: 4 additions & 4 deletions docs/user-guide/cli-configure-scs-on-headless-linux-os.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ To unlock the Gnome keyring automatically when you log in:
Zowe CLI does not contain the native, pre-built binaries that are required to access the credential vault on z/Linux operating systems. Developers must build the credential manager binaries on z/Linux systems during the Zowe CLI installation process.
For instructions to set up the credential manager binaries for Red Hat Enterprise Linux (RHEL) V8.X and Ubuntu z/Linux systems, refer to this section. See [Configuring RHEL V7.X](#configuring-rhel-v7x) for instructions specific to that distribution.
For instructions to set up the credential manager binaries for Red Hat Enterprise Linux (RHEL) V8.X and Ubuntu z/Linux systems, refer to this section. For instructions specific to RHEL V7.X, see [Configuring RHEL V7.X](#configuring-rhel-v7x).
To install and build the credential storage binaries on z/Linux RHEL V8.X and Ubuntu systems:
Expand Down Expand Up @@ -118,7 +118,7 @@ To install and build the credential storage binaries on z/Linux RHEL V8.X and Ub
Replace `#` with the major version of RHEL that is running on the z/Linux system.
4. [Unlock the keyring manually](#unlocking-the-keyring-manually) or [unlock the keyring automatically](#unlocking-the-keyring-automatically) to load and store credentials **[correct?]**.
4. [Unlock the keyring manually](#unlocking-the-keyring-manually) or [unlock the keyring automatically](#unlocking-the-keyring-automatically) to load and store credentials.
5. If you are configuring secure credential storage to run on RHEL V8.x or later, install Zowe CLI.
Expand Down Expand Up @@ -166,11 +166,11 @@ To install and build the credential storage binaries on z/Linux RHEL V7.X:
```
7. Install Zowe CLI.
8. [Unlock the keyring manually](#unlocking-the-keyring-manually) or [unlock the keyring automatically](#unlocking-the-keyring-automatically)to load and store credentials **[correct?]**.
8. [Unlock the keyring manually](#unlocking-the-keyring-manually) or [unlock the keyring automatically](#unlocking-the-keyring-automatically)to load and store credentials.
:::info important
The secure credential storage capability is installed every time that you install or update Zowe CLI. On RHEL V7.x, ensure that the Red Hat Developer Toolset is enabled every time you install or update Zowe CLI. When you do not enable the toolset, secure credential management is not available on the system. To ensure that the toolset is enabled when you install Zowe CLI, issue the following commands instead of the standard `npm install` commands. **[are these the exact commands, or are these example commands?]**
The secure credential storage capability is installed every time that you install or update Zowe CLI. On RHEL V7.x, ensure that the Red Hat Developer Toolset is enabled every time you install or update Zowe CLI. When you do not enable the toolset, secure credential management is not available on the system. To ensure that the toolset is enabled when you install Zowe CLI, issue the following commands instead of the standard `npm install` commands.
```
scl enable devtoolset-11 ‘npm install -g @zowe/cli@next’
Expand Down
4 changes: 2 additions & 2 deletions docs/user-guide/cli-configuringcli-ev.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ You can set the log level to adjust the level of detail that is written to log f

:::info Important

Setting the log level to `TRACE` or `ALL` might result in sensitive data being logged. For example, command line arguments will be logged when `TRACE` is set.
Setting the log level to `TRACE` or `ALL` might result in sensitive data being logged. For example, command line arguments are logged when `TRACE` is set.

:::

Expand All @@ -63,4 +63,4 @@ To change the location that the daemon uses, set the environment variables that
| Platform | Environment variable | Description | Values | Default |
| ---------------------- | ---------------------- | ---------------------- | ---------------------- | ---------------------- |
| All | `ZOWE_DAEMON_DIR` | Lets you override the complete path to the directory that will hold daemon files related to this user. The directory can contain the following files:<ul><li>`daemon.lock`</li><li>`daemon.sock`</li><li>`daemon_pid.json`</li></ul> | Any valid path on your computer | `<your_home_dir>/.zowe/daemon` <br/><br/> Examples: <br/><br/> Windows: `%HOMEPATH%\.zowe\daemon`<br/>Linux: `$HOME/.zowe/daemon` |
| Windows (only) | `ZOWE_DAEMON_PIPE` | Lets you override the last two segments of the name of the communication pipe between the daemon executable (.exe) and the daemon. | Any valid path on your computer | `\\.\pipe\%USERNAME%\ZoweDaemon` **[correct?]**
| Windows (only) | `ZOWE_DAEMON_PIPE` | Lets you override the last two segments of the name of the communication pipe between the daemon executable (.exe) and the daemon. | Any valid path on your computer | `\\.\pipe\%USERNAME%\ZoweDaemon`
2 changes: 1 addition & 1 deletion docs/user-guide/cli-configuringcli-evfile.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ Use a `.zowe.env.json` file *only* when it is not possible to set your own syste

## How `.zowe.env.json` works

When a Zowe command is issued, the command initializes the Imperative CLI Framework **[is Imperative something still used in V3?]**so that it loads all the utilities that allow the command to function. Imperative reads the `.zowe.env.json` configuration file and sets the environment variables before any loggers or Zowe CLI finish their own initialization.
When a Zowe command is issued, the command initializes the Imperative CLI Framework so that it loads all the utilities that allow the command to function. Imperative reads the `.zowe.env.json` configuration file and sets the environment variables before any loggers or Zowe CLI finish their own initialization.

The `.zowe.env.json` environment variables are set for only the duration of a Zowe CLI command.

Expand Down
20 changes: 10 additions & 10 deletions docs/user-guide/cli-install-configure-zosmf-security.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,28 @@

Review the tasks that security administrators must complete to configure z/OSMF security for your Zowe CLI implementation.

:::info **Required role: security administrator**
:::info Required role: security administrator
:::

## Configuring z/OS REST services SAF security

A security administrator must configure security to allow z/OSMF System Authorization Facility (SAF) access to the resources that Zowe CLI requires. Zowe CLI **[correct?]** uses REST endpoints that are associated with each z/OSMF REST API. After you complete all z/OSMF and z/OSMF cloud provisioning configurations, you can test your connection to z/OSMF to verify that Zowe CLI **[correct?]** can communicate with z/OS systems.
A security administrator must configure security to allow z/OSMF System Authorization Facility (SAF) access to the resources that Zowe CLI requires. Zowe CLI uses REST endpoints that are associated with each z/OSMF REST API. After you complete all z/OSMF and z/OSMF cloud provisioning configurations, you can test your connection to z/OSMF to verify that Zowe CLI can communicate with z/OS systems.

:::caution

Before you allow users to issue z/OS console commands with Zowe CLI **[correct?]**, security administrators should ensure that they provide access to commands that are appropriate for their organization.
Before you allow users to issue z/OS console commands with Zowe CLI, security administrators should ensure that they provide access to commands that are appropriate for their organization.

:::

The following table details the required z/OSMF REST services and examples of the Zowe CLI **[correct?]** features they enable. If the profile validation command returns any errors, use this table to find IBM documentation for the z/OSMF REST APIs.
The following table details the required z/OSMF REST services and examples of the Zowe CLI features they enable. If the profile validation command returns any errors, use this table to find IBM documentation for the z/OSMF REST APIs.

| z/OSMF REST Service | REST Endpoint | Description | More information |
| ----------- | ----------- | ---------- | ------------- |
| Cloud provisioning services | Endpoints that begin with: `/zosmf/provisioning/` | Cloud provisioning for development environments. | <ul><li>[Cloud provisioning services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-cloud-provisioning)</li></ul> |
| TSO/E address space services | Endpoints that begin with: `/zosmf/tsoApp` | TSO commands (`zowe zos-tso issue`). | <ul><li>[TSO/E address space services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-tsoe-address-space)</li><li>[Class activations that z/OSMF requires](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-security-configuration-requirements-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTapi)</li></ul> |
| z/OS console services | Endpoints that begin with: `/zosmf/restconsoles/`<br/> Example: `/zosmf/restconsoles/defcn` | Console commands (`zowe zos-console issue`). Any MVS console command such as MODIFY and DISPLAY. | <ul><li>[z/OS console services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-console)</li><li>[Updating your system for the z/OS console REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=time-updating-your-system-zos-console-rest-interface)</li><li>[Resource authorizations for the z/OS console services REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-security-configuration-requirements-zosmf#DefaultSecuritySetupForZosmf__zOSConsolesRestAPI)</li></ul> |
| z/OS data set and file REST interface | Endpoints that begin with: `/zosmf/restfiles/` Example: `/zosmf/restfiles/ds/<dsname>` | Create data sets (`zowe zos-files create`), delete data sets (`zowe zos-files delete`), read (download) data sets (`zowe zos-files download`), and write (upload) data sets (`zowe zos-files upload`). <br/>Access to access method services (IDCAMS) (`zowe zos-files invoke access-method-services`). | <ul><li>[z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-data-set-file-rest-interface)</li><li>[Updating your system for the z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=czft-updating-your-system-zos-data-set-file-rest-interface)</li><li>[Resource authorizations for the z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-security-configuration-requirements-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTdsfilesAPI)</li></ul> |
| z/OS jobs REST interface | Endpoints that begin with: `/zosmf/restjobs/` Example: `/zosmf/restjobs/jobs/<jobname>/<jobid>` | Submit jobs (`zowe zos-jobs submit`), purge jobs, and read job output. <br/>List jobs (`zowe zos-jobs list`). | <ul><li>[z/OS jobs REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-jobs-rest-interface)</li><li>[Resource authorizations for the z/OS jobs REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-security-configuration-requirements-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTapi)</li></ul> |
| TSO/E address space services | Endpoints that begin with: `/zosmf/tsoApp` | TSO commands (`zowe zos-tso issue`). | <ul><li>[TSO/E address space services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-tsoe-address-space)</li><li>[Class activations that z/OSMF requires](https://www.ibm.com/docs/en/zos/2.5.0?topic=guide-security-structures-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTapi__title__1)</li></ul> |
| z/OS console services | Endpoints that begin with: `/zosmf/restconsoles/`<br/> Example: `/zosmf/restconsoles/defcn` | Console commands (`zowe zos-console issue`). Any MVS console command such as MODIFY and DISPLAY. | <ul><li>[z/OS console services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-console)</li><li>[Updating your system for the z/OS console REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=time-updating-your-system-zos-console-rest-interface)</li><li>[Resource authorizations for the z/OS console services REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=guide-security-structures-zosmf#DefaultSecuritySetupForZosmf__zOSConsolesRestAPI__title__1)</li></ul> |
| z/OS data set and file REST interface | Endpoints that begin with: `/zosmf/restfiles/` Example: `/zosmf/restfiles/ds/<dsname>` | Create data sets (`zowe zos-files create`), delete data sets (`zowe zos-files delete`), read (download) data sets (`zowe zos-files download`), and write (upload) data sets (`zowe zos-files upload`). <br/>Access to access method services (IDCAMS) (`zowe zos-files invoke access-method-services`). | <ul><li>[z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-data-set-file-rest-interface)</li><li>[Updating your system for the z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.2.0?topic=czft-updating-your-system-zos-data-set-file-rest-interface)</li><li>[Resource authorizations for the z/OS data set and file REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=guide-security-structures-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTdsfilesAPI__title__1)</li></ul> |
| z/OS jobs REST interface | Endpoints that begin with: `/zosmf/restjobs/` Example: `/zosmf/restjobs/jobs/<jobname>/<jobid>` | Submit jobs (`zowe zos-jobs submit`), purge jobs, and read job output. <br/>List jobs (`zowe zos-jobs list`). | <ul><li>[z/OS jobs REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zos-jobs-rest-interface)</li><li>[Resource authorizations for the z/OS jobs REST interface](https://www.ibm.com/docs/en/zos/2.5.0?topic=guide-security-structures-zosmf#DefaultSecuritySetupForZosmf__ResourceAuthorizationsForRESTapi__title__1)</li></ul> |
| z/OSMF workflow services | Endpoints that begin with: `/zosmf/workflow/` | Cloud provisioning for development environments. | <ul><li>[z/OSMF workflow services](https://www.ibm.com/docs/en/zos/2.5.0?topic=services-zosmf-workflow)</li></ul> |

## Configuring z/OS console REST interface
Expand All @@ -49,11 +49,11 @@ Review the following recommendations for configuring the z/OS security for data
- Define at least 20971520 KB (20 MB) the IPCMSGQBYTES option of your parmlib member named BPXPRMxx. IBM recommends this value to let TSO and z/OSMF communicate using z/OS USS interprocess communications.

## Configuring z/OSMF plug-in security
Ensure that you implement all the required security for the plug-ins. For more information, see [Setting up security for the z/OSMF plug-ins](https://www.ibm.com/docs/en/zos/2.2.0?topic=configuration-setting-up-security-zosmf-plug-ins) in the IBM Documentation.
Ensure that you implement all the required security for the plug-ins. For more information, see [Setting up structures for z/OSMF](https://www.ibm.com/docs/en/zos/2.5.0?topic=guide-security-structures-zosmf) in the IBM Documentation.

:::note

- For systems that are secured by RACF, ensure that the TRUSTED attribute is assigned to the CEA started task.
- To implement the use of certificates to access Zowe CLI **[correct?]**, security administrators can configure the certificates for Zowe CLI **[correct?]** users. For more information, see [Using the z/OSMF REST services](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-using-zosmf-rest-services) in the IBM Documentation.
- To enable Zowe CLI to authenticate to z/OSMF using certificates, security administrators can configure the certificates for Zowe CLI users. For more information, see [Using the z/OSMF REST services](https://www.ibm.com/docs/en/zos/2.2.0?topic=guide-using-zosmf-rest-services) in the IBM Documentation.

:::
Loading

0 comments on commit 506bfa6

Please sign in to comment.