Check if you have enabled surrogat on the system.
SETROPTS CLASSACT(SURROGAT)
Ok, now you must create the WEBSRV user and define our surrogat.
ADDUSER WEBSRV DFLTGRP(IMWEB) OMVS(UID(0) HOME('/usr/lpp/internet') PROGRAM('/bin/sh'))
RDEFINE FACILITY BPX.DAEMON UACC(NONE) NOTIFY(WEBSRV)
RDEFINE FACILITY BPX.SERVER UACC(NONE) NOTIFY(WEBSRV)
PERMIT BPX.DAEMON CLASS(FACILITY) ID(WEBSRV) ACCESS(READ)
PERMIT BPX.SERVER CLASS(FACILITY) ID(WEBSRV) ACCESS(UPDATE)
And the public user (minimal privileges).
Check for group EXTERNAL, if not exists, you can create it.
ADDGROUP EXTERNAL OMVS(GID(999))
ADDUSER PUBLIC DFLTGRP(EXTERNAL) OMVS(UID(998) HOME('/') PROG('/bin/sh'))
Surrogates for default config
RDEFINE SURROGAT BPX.SRV.WEBADM UACC(NONE)
RDEFINE SURROGAT BPX.SRV.PUBLIC UACC(NONE)
PERMIT BPX.SRV.WEBADM CLASS(SURROGAT) ID(WEBSRV) ACCESS(READ)
PERMIT BPX.SRV.PUBLIC CLASS(SURROGAT) ID(WEBSRV) ACCESS(READ)
And now, refresh surrogat list on SETROPTS
SETROPTS RACLIST(SURROGAT) REFRESH
Ok, now in the console (or SDSF panel) you can start the web server
/S HTTPD