E-SRF. Security Signature Analysis. Release EKC Security Reporting Facility GENERAL AVAILABILITY. September 1, 2005 EKC Inc.

Transcription

1 E-SRF EKC Security Reporting Facility Security Signature Analysis Release E-SRF V2R1M0 GENERAL AVAILABILITY September 1, 2005 EKC Inc.

2 E-SRF is a proprietary product developed and maintained by EKC Inc West Higgins Road Rosemont, Illinois USA (847) Technical Support: (847) EKC, Inc. provides only software program products which fully comply with, and maintain MVS integrity. The vendor hereby warrants that: 1) E-SRF ("Software") performs only those functions which are described in the published specifications; 2) there are no methods for gaining access to the Software or other computer resources or data of Licensee (such as a master access key, ID, password, or trap door) other than set forth in the published specifications; 3) the Software does not introduce any MVS integrity exposures. The program code, with the exception of one utility, runs totally in non-authorized, problem state. The one utility, EKCRXCAT, requires APF-authorization to read the MVS System Catalogs. A non-apf authorized utility, EKCRGCAT, is supplied to perform the same function, but at a considerably slower speed. 4) the software shall be year 2000 compliant, and shall function correctly in the next century according to published specifications as long as regular software maintenance is applied. Copyright EKC Inc. USA, 2005 All Rights Reserved Reproduction of this manual without written permission of EKC Inc. is strictly prohibited. Version 2, Release 1 September 1, 2005 All product names referenced herein are trademarks of their respective companies. Printed in USA Release 2.1 Revised September 1, 2005 ii

3 Contents E-SRF Security Signature Analysis...1 Introduction...1 JCL for Executing an E-SRF Security Signature Scan...2 SUMMARY DD OUTPUT...3 Scan Signature Types...6 Signature Scanning Control Parameters...7 Messages...9 Release 2.1 Revised September 1, 2005 iii

4 E-SRF Publications Name Installation Guide Contents E-SRF installation including: installation and maintenance steps, startup and shutdown considerations, and backup and recovery procedures. Change Summary Guide Contains all new features and system function changes. General Overview Resource Grouping Facility Guide Access Analysis Reports Guide for ACF2 Access Analysis Reports Guide for RACF Event Reporting User Guide An overview of E-SRF and its components. Brief overview of the Resource Grouping Facility, its relationship to E-SRF, language command syntax, TSO commands and JCL. Brief overview of Access Analysis reports, explanation of the DataOwner and Userid/LogonidOwner reports, command syntax, utilities necessary for creating input to reports, and JCL. A How To guide for users of E-SRF Event Reporting. Event Reporting Facility - Command Reference Explains the Event Reporting Facility command processor, command syntax, and JCL. Event Reporting Facility - Masterfile and Data Dictionary Reference Event Reporting Facility - Messages and Codes Event Reporting Facility - Report Overlays Guide Explains the structure of the E-SRF Masterfile and describes all Masterfile fields. Lists Event Reporting Facility messages and codes. An overview of the report overlays provided with the Event Reporting Facility. Release 2.1 Revised September 1, 2005 iv

5 E-SRF Security Signature Analysis Introduction Over time, things accumulate. Eventually, the clutter increases such that it becomes difficult to find things. This, of course, also happens with software and program libraries. As things accumulate, it may become difficult to find programs that perform certain functions. Locating programs doing security functions becomes important when changes have to be made. Whether upgrading security, implementing role modeling, or just plain remodeling, it becomes necessary to locate all programs related to security to keep everything working correctly. However, sometimes finding them all proves to be a challenge. This facility of E-SRF, the E-SRF Security Signature Analysis Reporting feature, was specifically developed to help when programs performing security related functions and calls accumulate. It locates those programs doing security kinds of things - and, it works for libraries of all types. Source code, object libraries, or load modules may be searched. Any program(s) containing traces of security types of information will be flagged and reported. The sole purpose of this E-SRF Signature Analysis Reporting program is to locate programs in libraries that are performing security type functions. This facility scans programs, searching for those that may be invoking RACF, CA-ACF2, or CA-TopSecret; or anything pertaining to security. These scanning functions are very useful when trying to locate legacy code performing security calls, particularly if the source code is no longer available. E-SRF Security Signature Analysis Page 1

6 JCL for Executing an E-SRF Security Signature Scan //LIBSCAN JOB (),'SCAN',CLASS=A,MSGCLASS=X, // MSGLEVEL=(1,1),NOTIFY=USERID //* //* THIS PROGRAM SCANS FOR SECURITY SIGNATURES //* IN LIBRARIES. //* //* //SCAN EXEC PGM=ESRS0SAR,REGION=4M //SYSUDUMP DD SYSOUT=* //SYSPRINT DD SYSOUT=* //SUMMARY DD SYSOUT=* //LIST0001 DD SYSOUT=* //INDD1 DD DISP=SHR,DSN=LIBRARY.PDS.LOAD //INDD2 DD DISP=SHR,DSN=LIBRARY.PDS.SOURCE //USERDICT DD DISP=SHR,DSN=USER.DICT.DATA //SYSIN DD * * CONTROL CARD INPUT STREAM * DO A COMPLETE SCAN FOR ANY KIND OF * SECURITY SIGNATURE FOR INDD1 AND INDD2 * SCAN DETAIL MAX-PASS USERDICT * * //* Signature analysis is executed as a batch JOB. The required JCL is shown above. The input libraries to be scanned are allocated by the INDD DD JCL statement. All DDNAMEs beginning with the characters INDD are scanned by the analysis program. In the example above, both the INDD1 and INDD2 statements point to libraries that are to be scanned. The USERDICT DD statement applies to all scans for all libraries in this JOB step. E-SRF Security Signature Analysis Page 2

7 SYSPRINT DD OUTOUT E-SRF IS A LICENSED PROGRAM PRODUCT OF EKC,INC.; ALL RIGHTS RESERVED. ESRS0SAR(I)-001,SIGNATURE FUNCTIONS BEING STARTED SCAN ALL MAX-PASS USERDICT ESRS0SAR(I)-020,FUNCTION COMPLETED, RC=0000,RE=0000 ESRS0SAR----OPTIONS IN EFFECT: Options Display is ACTIVE Scan is Set to MAX-PASS PDS Member Name Display is ON Count Data for Member is OFF Scanning for TEXT ESD OPCODE SVCS USER ESRS0SAR(I)-090,HIGHEST RETURN CODE FOR JOB WAS RC=0000 ESRS0SAR(I)-099,ALL AVAILABLE FUNCTIONS COMPLETE SUMMARY DD OUTPUT ESRS1SAR,E-SRF SECURITY REPORTING FACILITY---SIGNATURE ANALYSIS ROUTINE E-SRF Is A Licensed Program Product of EKC,Inc. Printed on 2005/08/02 by USERID ESRS1SAR(I)-100,Active RSS on System Z390 is RACF Read>* Read> EKC Using>>EKC *** Printing Dictionary Entries *** DEFINE USER DICTINARY ENTRIES Read> ACF60 Using>>ACF60 Read> ACF** Using>>ACF** Read>* ESRS1SAR(I)-020,E-O-F,SAMPLE.LOAD,LAST MEMBER READ: ETFRMENU ESRS1SAR(I)-022,MEMBER(S) W/SECURITY SIGNATURE(S): 09 *----READ SCANNED-- ---ALIAS---- -SIGNATURES-* *----z/os ACF RACF TSS-----* ESRS1SAR(I)-010,TOTAL RECORDS SUMMARY BELOW: *----READ SCANNED-- ---ALIAS---- -SIGNATURES-* *----z/os ACF RACF TSS-----* E-SRF Is A Licensed Program Product of EKC,Inc.; ALL RIGHTS RESERVED. E-SRF Security Signature Analysis Page 3

8 **** E-SRF Security Signature - Statistics Summary **** JES JOB ID...JOB08559 Files Searched...1 JOBname...EBSCAN Members Read...9 PROCname...SCAN Dictionary...3 STEPname...SCAN Signatures UserID...EB Match-Dict Date /08/02 All Others...52 Time...15:44:20 Members W/Sign...9 SMFID...P390 Max Signs/Mem EKC SiteID...C Min Signs/Mem...10 Max Signs/DSN Min Signs/DSN ESRS1SAR(I)-030,E-O-S,Highest Return Code,RC=00 E-SRF Is A Licensed Program Product of EKC,Inc.; ALL RIGHTS RESERVED. E-SRF Security Signature Analysis Page 4

9 ********************************* TOP OF DATA *************************** ESRS1SAR,E-SRF SECURITY REPORTING FACILITY---SIGNATURE ANALYSIS ROUTINE E-SRF Is A Licensed Program Product of EKC,Inc. Printed on 2005/08/02 by ESRS1SAR(I)-100,Active RSS on System P390 is RACF ESRS1SAR(I)-000,MA,1,EKSTG2,PO,U,DDNAME=INDD1 - SAMPLE.LOAD *-TYPE/SUBS-- -MODULE- -COUNT-OFFSET-SIGNATURE DATA------* USER-z/OS EKC00INF EKC z/os-z/os EKC00INF...1 ***ESD EKC USER-z/OS EKC00INF...1 ***ESD EKC > EKC00INF Total Count For Module=...10 USER-z/OS EKC00INI E EKC USER-z/OS EKC00INI F0 EKC z/os-z/os EKC00INI...12 ***ESD EKC z/os-z/os EKC00INI...1 ***ESD ETFR RACF-z/OS ETFRMENU EB USERID RACF-z/OS ETFRMENU F1 GROUP RACF-z/OS ETFRMENU B RACF z/os-z/os ETFRMENU...1 ***ESD ETFR > ETFRMENU Total Count For Module=...28 ESRS1SAR(I)-020,E-O-F,EB.ETFR.LOAD,LAST MEMBER READ: ETFRMENU ESRS1SAR(I)-022,MEMBER(S) W/SECURITY SIGNATURE(S): 09 *----READ SCANNED-- ---ALIAS---- -SIGNATURES-* *----z/os ACF RACF TSS-----* In the above example, security signatures were detected in the specified library. The first occurrence of a signature is printed along with its associated offset from the beginning of the module for each record section scanned, and multiple signatures of the same type with different offsets may appear. Note that for non-load module libraries the relative block number of the record just read is displayed instead. E-SRF Security Signature Analysis Page 5

10 Scan Signature Types String Data - Code Signatures - ESD - Displayed with the relative block number into the dataset (or member if a PDS) for the first occurrence of that particular string for non-load modules. Load modules show the signature data with an offset value into the load module instead. (Multiple occurrences may show a count value greater than 1 for the same signature, or may have multiple occurences, depending upon other data detected; either is correct.) Signatures of code sequences are displayed with offset and count values. These signatures are unique code sequences or security SVC calls. External Symbol Data entries will be flagged as ***ESD and will not have an offset or relative block number, since these are linkage edit/load module indicators making reference to another CSECT. E-SRF Security Signature Analysis Page 6

11 Signature Scanning Control Parameters E-SRF security signature scanning is controlled by parameters. These control parameters appear as card image input read from the SYSIN file specified in the JCL. They control the type of scanning to be performed, and how extensively to pursue it. These parameters fall into two categories: What to scan for and how extensively, and information to be printed. They consist of a command to the program, and additional operands as may be required. The SYSIN Control Parameters, or control cards are as specified below. SYSIN Control Cards Commands SCAN SUMMARY OPTIONS END - Initiates a scan request. Specified without operands or a user dictionary it initiates a read only operation to verify the contents of a file without performing a signature contents search. Default without operands is READ USER. - Print a summary report only. This command ignores the LISTnnnn DD Statement. Default without operands is DETAIL ONE-PASS USER - Prints control options in effect for each subsequent command as part of the SYSPRINT output. - Terminates all scan functions and exits. E-SRF Security Signature Analysis Page 7

12 Operands Controlling the Type of SCAN DETAIL GENERAL USER READ - Scan for every type of signature. This is a full scan and includes scans for security signatures in TEXT, it includes ESD, OPCODE, and SVCs searches for load modules, and also searches for any text matching optional user dictionary (USERDICT DD STATEMENT in JCL.) entries. This is the default for a summary command. - Scan for general security text. This type of scan is most useful when scanning source libraries for locally developed security calls. It does not search for vendor or security product specific signatures. User dictionary entries may be included in the scan if the USERDICT DD card is present in the JCL. - Limits searches to only data defined by the USERDICT DD statement. This operand is ignored if no USERDICT DD statement is specified in the JCL. - Specified without a USERDICT it initiates a read only operation to verify the data integrity of a file without an actual signature contents search. This is the default value for a scan command without operands.. Operands Controlling How Extensively to SCAN ONE-PASS MIN-PASS MAX-PASS - A very fast scan. The scanning proceeds only until a single instance of any specified signature is found, or until end of module. Once any type is located, the scanning proceeds to the next member in the library. This scan is useful for limiting the more intensive scans to the most likely candidates. - Scan until at least one instance of every type selected has been located, or the entire module is scanned until end of module. - Scan for every instance of the type(s) requested, and do not terminate scan until any and all instances which may exist are located. This is the most intensive scan; use it when a lighter scan has narrowed the search to the lost likely candidates. Operands Controlling Information to be Printed VENDOR USERDICT - Normal operation precludes printing information about modules containing IBM or Computer Associates programs; this reduces clutter. Specify VENDOR to force printing information for all security related modules. Specifying this option may result in longer scan times and voluminous output. It would normally be used after an initial scan has narrowed search results. - Causes the User Dictionary file, DDNAME=USERDICT, to be echoed in the SUMMARY report. Default value is to suppress this printout. E-SRF Security Signature Analysis Page 8

13 Messages ESRS0SAR(I)-001,SIGNATURE FUNCTIONS BEING STARTED An informational message indicating the program has initialized, and is ready to perform scanning functions. ESRS0SAR(W)-002,NO SIGNATURE FUNCTION(S) REQUESTED A warning message indicating no commands were in the command input stream. ESRS0SAR(E)-012,MODULE NOT FOUND >>> mmmmmm A requested routine,mmmmmmmm, was missing. This is probably an installation error. Contact your systems programmer ESRS0SAR(E)-013,MUTUALLAY EXCLUSIVE >>> oooooooo The command/operand(s) combinationoooooooo conflicts. The command was not executed. ESRS0SAR(E)-014,OPERAND NOT FOUND >>> oooooooo The operandoooooooo is either misspelled, or otherwise syntactically incorrect. Correct the operand and re-run the JOB. ESRS0SAR(E)-015,COMMAND NOT FOUND >>> cccccccc The command cccccccc is either misspelled, or otherwise syntactically incorrect. Correct the syntax and re-run the JOB. ESRS0SAR(E)-016,INVALID CONTROL INPUT>>> --image-- The image is not valid command entry syntax. Correct the command syntax and re-run the JOB. ESRS0SAR(I)-020,FUNCTION COMPLETED, RC=cccc, RE=eeee A Signature Analysis command function has completed. The return code from this command was cccc, along with its associated reason code. ESRS0SAR(I)-090,HIGHEST RETURN CODE FOR JOB WAS RC=nnnn The Signature Analysis program has completed. The final, highest, return code from all program functions was nnnn. ESRS0SAR(I)-099,ALL AVAILABLE FUNCTIONS COMPLETE The Signature Analysis program JOBSTEP has ended. ESRS1SAR(I)-000,oo,C,volume,PO PS,F U V,DDNAME=ddn - dsname The Signature Analysis program is processing program library dsname from DDNAME ddn which is located on volume volume. Only the first volume is read. If C is greater the one, additional DD cards pointing must be added. ESRS1SAR(W)-001,MULTI-VOLUME(M) DATASET, dsname A warning that the current dataset being processed resides on multiple volumes. Only the first volume is processed by the Signature Analysis Routines. Add the appropriate DD cards to process other volumes. ESRS1SAR(E)-003,Summary DDNAME Missing,Ended,RC=12 The Signature Analysis Routines require a DDNAME of SUMMARY be present in the JCL; the JOB is terminated with a return code of 12. Add the required DD card and re-run the JOB. ESRS1SAR(I)-010,TOTAL RECORDS SUMMARY BELOW: This is a Summary Information recap of the previous function(s). E-SRF Security Signature Analysis Page 9

14 ESRS1SAR(I)-011,PARMS: This message optionally displays the parameters selected for the requested function as a result of an Options command in the command input stream. ESRS1SAR(I)-020,E-O-F,<LAST MEMBER READ:mmmmmmmm> Membermmmmmmmm was the last member read from the input file scanned if it was a partitioned dataset. ESRS1SAR(I)-022,MEMBER(S) W/SECURITY SIGNATURE(S): nnnn The count of membersnnnn contained in the library just scanned containing valid security signatures. ESRS1SAR(I)-030,E-O-S,Highest Return Code,RC=nnnn End of Scan; the Signature Analysis command function has completed. The return code was nnnn ESRS1SAR(I)-100,Active RSS on System ##id is ACF2 RACF TSS E-SRF has determined that the currently active Resident Security System on CPU with SMF ID ##id is one of either ACF2, RACF, or TopSecret. ESRS1SAR(E)-901,User Dictionary Failed to Open A USERDICT DD statement specified in the JCL referred to dataset that could not be opened. Correct the JCL and re-run the JOB. ESRS1SAR(E)-904,CANNOT OPEN DDNAME= dddddddd A DD statement of dddddddd specified in the JCL referred to dataset that could not be opened. Correct the JCL and re-run the JOB. ESRS1SAR(E)-905,First byte is not comment: tttt The text tttt found I column 1 of the input stream was not a valid comment card. Correct the input commands and re-run the JOB. ESRS1SAR(W)-906,No Library(s) to Process,Ended,RC=4 No commands were specified in the command input stream. Correct the JCL and re-run the JOB ESRS1SAR(E)-907,Invalid User Dictionary Data: A USERDICT DD statement specified in the JCL referred to dataset containing invalid dictionary data strings. Correct the JCL or dictionary data and re-run the JOB. ESRS1SAR(E)-916,FATAL INTERNAL ERROR A fatal error occurred; and the JOB was halted. Check other accompanying messages to determine the nature of the error. If no other messages are present contact your systems programmer or EKC Technical Support. E-SRF Security Signature Analysis Page 10