OMEGAMON Enhanced 3270UI Webcast

Transcription

1 OMEGAMON Enhanced 3270UI Webcast Securing your Enhanced 3270UI Deployment Speaker: Matt S Aiken January 25, 2018 Matt Aiken msaiken@us.ibm.com Joe Winterton josephw@us.ibm.com

2 OMEGAMON Enhanced 3270UI Updates Modernizing OMEGAMON Webcasts: YouTube channel changed to IBM Z, new link now Register and Access prior Videos at the Enhanced3270ui Wiki ibm.biz/enhanced3270ui IBM Z channel Playlist: Very well attended with more than 8000 views thus far

3 Agenda ØEnhanced 3270UI Security Overview ØDefining SAF resource profiles ØEstablishing user access control ØWhat can you secure? ØDemo

4 Topics not covered here: ØDefining RACF Classes ØParmgen Configuration ØPassTicket Generation ØSSL Sockets ØOMEGAMON Classic Security

5 Enhanced 3270UI Overview Security is defined through SAF only Allows security to be managed by site security products OMEGAMON Classic security profiles can be used as a template but a separate class should be defined for the Enhanced 3270UI Take Action Security is authorized by the UI as well as the OMEGAMON Agent Parmgen variables RTE_SECURITY_CLASS KOB_SAF_LOGON_CLASS_NAME KOB_SAF_QUERY_CLASS_NAME KOB_SAF_ACTION_CLASS_NAME KOB_SAF_LOGON_RESOURCE_PREFIX

6 Enhanced 3270UI Overview $OMEGDEMO A pseudo security class to allow the interface to run in demo mode. (No security checking!)

7 Define RACF Class CLASS NAME CDT $KOBTEST CDTINFO INFORMATION CASE = UPPER DEFAULTRC = 004 DEFAULTUACC = NONE FIRST = ALPHA NATIONAL GENLIST = DISALLOWED GENERIC = ALLOWED GROUP = KEYQUALIFIERS = MACPROCESSING = NORMAL MAXLENGTH = 246 MAXLENX = MEMBER = OPERATIONS = NO OTHER = ALPHA NATIONAL NUMERIC SPECIAL POSIT = PROFILESALLOWED = YES RACLIST = REQUIRED SECLABELSREQUIRED = NO SIGNAL = NO

8 Defining SAF Profiles In all cases of resource checking, the SAF class name used is the name that was configured for the Enhanced 3270UI address space with the RTE_SECURITY_CLASS environmental variable. For security products other than RACF use the corresponding commands instead of RDEFINE and PERMIT to perform the same type of function.

9 Defining SAF Profiles cont. RDEFINE <class name> <saf profile> UACC(NONE/READ) PERMIT <saf profile> ID(<user/group>) ACCESS(NONE/READ/UPDATE) CLASS(<class name>) Example: RDEFINE $KOBTEST KOB.LOGON.** UACC(NONE) SETROPTS RACLIST ($KOBTEST) REFRESH PERMIT KOB.LOGON.** ID(USER4) ACCESS(READ) CLASS($KOBTEST) SETROPTS RACLIST ($KOBTEST) REFRESH

10 What can you secure? Logon: Logon to an instance of the Enhanced 3270UI Allowed: KOB.LOGON.* ACCESS(READ) Denied: KOB.LOGON.* ACCESS(NONE) Example RDEFINE $KOBTEST KOB.LOGON.** UACC(NONE) PERMIT KOB.LOGON.** ID(USER4) ACCESS(READ) CLASS($KOBTEST)

11 What can you secure? End User Activities: View data for a specific table on a specific managed system The authority to issue query requests from the OMEGAMON enhanced 3270 user interface to a product agent instance is verified by checking for access to an SAF resource named in this pattern: Kpp.msn.tablename Kpp: Product code of the agent instance. Ex. CICS (KCP) msn: Managed System Name tablename: Name of the data source(attribute group, or table) defined within the product agent. Allowed: KCP.** ACCESS(READ) Denied: KCP.** ACCESS(NONE)

12 What can you secure? End User Activities: Take Action on a specific managed system Take Actions allow the user to carry out product specific tasks. As these are product specific each will have their own profiles. CICS: KCP.smfid.cicsname.TAKEACTION Allowed: KCP.**.TAKEACTION ACCESS(UPDATE) Denied: KCP.**.TAKEACTION ACCESS(NONE) z/os: KM5.msn.TAKEACTION Allowed:KM5.**.TAKEACTION ACCESS(UPDATE) Denied: KM5.**.TAKEACTION ACCESS(NONE) *Please refer to product documentation for other product Take Action profiles.

13 What can you secure? End User Activities: Change Auto-Update intervals Auto-Update intervals sets when a workspace is refreshed without user hitting enter. As workspace queries are reissued during each update interval you may want to lock in a specific timing interval for your Enhanced 3270UI. Allowed: KOBUI.ADMIN.PREFS.AUTOUPDATE ACCESS(READ) Denied: KOBUI.ADMIN.PREFS.AUTOUPDATE ACCESS(NONE)

14 What can you secure? End User Activities: Issue commands from the command line From the command line you can control various aspects of your current session. Some of these commands allow you to LOGOFF, HOME, find, access pull downs, and fast path to name a few. Allowed: KOBUI.USER.COMMAND.* ACCESS(READ) Denied: KOBUI.USER.COMMAND.* ACCESS(NONE)

15 What can you secure? End User Activities: Create/Modify members with same User ID A user may want to modify, or clone datasets that belong to their User ID such as their own profile. Allowed: KOBUI.ADMIN.MEMBER.WRITE.RKOBPFSV.<USER> ACCESS(READ) Denied: KOBUI.ADMIN.MEMBER.WRITE.RKOBPFSV.<USER> ACCESS(NONE)

16 What can you secure? User Interface Administration Activities: The Enhanced 3270UI gives you the ability to carry out administrative tasks. While this is of value to an administrator it may not be valid for a non-privileged User. List Users Allowed: KOBUI.ADMIN.LISTUSERS ACCESS(READ) Denied: KOBUI.ADMIN.LISTUSERS ACCESS(NONE) Kill User Sessions Allowed: KOBUI.ADMIN.KILLUSERS ACCESS(READ) Denied: KOBUI.ADMIN.KILLUSERS ACCESS(NONE)

17 What can you secure? User Interface Administration Activities: Start/Stop UI tracing Allowed: KOBUI.ADMIN.TRACE.UI ACCESS(READ) Denied: KOBUI.ADMIN.TRACE.UI ACCESS(NONE) Start/Stop internal tracing Allowed: KOBUI.ADMIN.TRACE.INTERNAL ACCESS(READ) Denied: KOBUI.ADMIN.TRACE.INTERNAL ACCESS(NONE) Save Dataset member with name other than User Allowed: KOBUI.ADMIN.MEMBER.WRITE.* ACCESS(READ) Denied: KOBUI.ADMIN.MEMBER.WRITE.* ACCESS(NONE)

18 What can you secure? User Interface Administration Activities: NTH Configuration Allowed: KOBUI.ADMIN.DEFINEHISTORY.* ACCESS(READ) O4SRV.** ACCESS(READ) Denied: KOBUI.ADMIN.DEFINEHISTORY.* ACCESS(NONE) O4SRV.** ACCESS(NONE) Hub TEMS Allowed: KOBUI.ADMIN.USEHUB.* ACCESS(READ) Denied: KOBUI.ADMIN.USEHUB.* ACCESS(NONE)

19 Helpful Links: _share.doc_ /zcommonconfig/complete_security_e3270_cpcg.htm