z/tpf File System Security Update

Transcription

1 z/tpf EE V1.1 z/tpfdf V1.1 TPF Toolkit for WebSphere Studio V3 TPF Operations Server V1.2 IBM Software Group TPF Users Group Fall 2006 z/tpf File System Security Update z/tpf PUT03 APAR PJ30915 Name : Venue : Stephen Record Database / TPFDF Subcommittee AIM Enterprise Platform Software IBM z/transaction Processing Facility Enterprise Edition Any references to future plans are for planning purposes only. IBM reserves the right to change those plans at its discretion. Any reliance on such a disclosure is solely at your own risk. IBM makes no commitment to provide additional information in the future. ~ prz 10/30/06 Pages 1

2 Topics Permissions Protecting files and commands New commands for administrators and users Some examples Other new facilities Getting started ~ prz 10/30/06 Pages 2

3 But first, some clues to our motivation... Requirements that become available with this support TUG D ZFILE login / logout TUG D file system userid / password administration ~ prz 10/30/06 Pages 3

4 Permissions Ownership & permissions are central to file system security each file has an owner and a group assigned at creation time to the uid and gid of the creator may be altered (by owner or root only) using ZFILE chown each file has an array of permission settings Three levels of permission owner group member other (i.e. everyone else) Three kinds of permissions at each level read permission allows you to examine the contents of the file write permission allows you to change the contents of the file execute permission allows you to run the file as a program Directory permissions operate slightly differently read permission allows you to see what files are in the directory write permission allows you to create and delete files in the directory execute permission allows you to search for a specific file in the directory ~ prz 10/30/06 Pages 4

5 Protecting files and commands User's responsibilities attach appropriate permissions to your files and directories maintain and safeguard your password Administrator's responsibilities create the configuration file /etc/login.defs create users and groups assign users to groups reset passwords when necessary protect system directories that contain valuable files restrict access to sensitive commands assign permissions to special files in /sbin/zcmds representing those commands control who may execute those commands, either directly or via ZSTIM ~ prz 10/30/06 Pages 5

6 New command for general users New command for general users ZPVFS - log in to and log out of the z/tpf file system login to the file system temporarily login as a different user logout re-establishes the previously logged in user logout of the file system note that pre-existing FTP client sessions, if any, are disconnected during any login or logout change password display the user who is currently logged in may not be entered from the prime CRAS prime CRAS implicitly has root authority ~ prz 10/30/06 Pages 6

7 New commands for system administrators New commands for system administrators ZOVFS - manage file system users and groups initialize or reinitialize file system security make or remove users or groups add users to groups or remove users from groups change passwords, UIDs or GIDs of users disable or enable file system security may be entered only from the prime CRAS ZFILE prot - control the usage of commands build or rebuild the protection file tree from the internal table table defined in i_prot.h display the protection characteristics of a command add a command or subcommand to the protection file tree modify or delete an existing command or subcommand entry must have appropriate privileges to update the file protection tree prime CRAS logged in as root ~ prz 10/30/06 Pages 7

8 Sample /etc/login.defs file Sample /etc/login.defs file # # min/max values for automatic uid selection # UID_MIN 500 #default in z/tpf UID_MAX #default in z/tpf # # min/max values for automatic gid selection # GID_MIN 500 #default in z/tpf GID_MAX #default in z/tpf # # password aging controls # PASS_MAX_DAYS 90 #password valid for maximum of 90 days PASS_WARN_AGE 7 #warning msg 7 days before expiration # USERGROUPS_ENAB yes #remove user group if no members exist ~ prz 10/30/06 Pages 8

9 Examples of using of ZFILE prot Examples of using of ZFILE prot The following example protects the ZAREC command. This permission file belongs to the user "operator" and is associated with the group "adm". User: zfile prot -a arec,750,operator,adm System: FILE0001I START OF DISPLAY FROM prot -a... AREC protected, mode 750 END OF DISPLAY Effect: The ZAREC command may be executed only by the user "operator" or members of the group "adm". ~ prz 10/30/06 Pages 9

10 Examples of using of ZFILE prot (continued( continued) The following example shows how to give different levels of protection to the subcommands of a command such as ZINET. This permission file belongs to the user "netopr" of the group "net". User: zfile prot -a inet,700,netopr,net System: FILE0001I START OF DISPLAY FROM prot -a... INET protected, mode 700 END OF DISPLAY User: zfile prot -as inet,dis,555,netopr,net System: FILE0001I START OF DISPLAY FROM prot -as... Subcommand DIS in INET was protected, mode 555 END OF DISPLAY Effect: The ZINET DISPLAY command may be executed by any user, but other ZINET subcommands may be executed only by "netopr". ~ prz 10/30/06 Pages 10

11 New TPF Operations Server console configuration parameter hide_stringx indicates a string to match against a command with password fields to be masked (hidden) from displaying in the command area console.hide_string1=zpvfs LOGON %visible% %hide% matches:zpvfs logon josh k9ch33se displays: zpvfs logon josh ******** console.hide_string2=zovfs chgusr %v% oldpswd %h% newpswd %h% %h% matches:zovfs chgusr josh oldpswd k9ch33se newpswd t3de0ac9 t3de0ac9 displays: zovfs chgusr josh oldpswd ******** newpswd ******** ******** Available in TPF Operations Server V (GA May 2006) ~ prz 10/30/06 Pages 11

12 New APIs New APIs tpf_getlogin() get user login information obtain information about the user that is logged in to the file system tpf_setlogin() set the UID and GID of the caller set the user ID (UID) and group ID (GID) of the caller program KEY0 authorization required tpf_setcurusr() set the UID and GID of the caller with the current user login information retrieve the user ID (UID) and group ID (GID) of the user that is logged into the file system and set the UID and GID of the caller program with this information called from CVAU (system message processing) tpf_validatezcmd() validate the user's access to a command check the authority of the user to execute the specified command called from CVAU if the system generation option OPSEC is turned on ~ prz 10/30/06 Pages 12

13 New user exit cfve.c for password encryption New user exit cfve.c for password encryption void encrypt_pswd(struct vf_epass *p) { /* struct vf_epass */ /* { */ /* char *in_passw; // input: plain text password */ /* char *out_passw; // output: encrypted password */ /* int outlen; // output: length of encrypted passwd */ /* } */ /************************************************************/ /* 1. malloc storage for p->out_passw */ /* 2. provide your code to encrypt p->in_passw */ /* (consider using tpf_cryptc() to do the heavy lifting) */ /* 3. copy the encrypted password to p->out_passw */ /* 4. set p->outlen to the length of the encrypted password */ /************************************************************/ p->outlen = -1; // no encryption performed } ~ prz 10/30/06 Pages 13

14 Getting started Create file /etc/login.defs create offline and transfer to z/tpf with ftp, or... create directly on z/tpf using ZFILE commands zfile echo UID_MIN 500 > /etc/login.defs zfile echo UID_MAX >> /etc/login.defs [and so forth] Initialize file system security zovfs init Initialize command protection zsysg alter opsec zripl zfile prot -R Create users and groups zofvs mkusr... zovfs mkgrp... zovfs addgrp... Specify commands to protect zfile prot -a... ~ prz 10/30/06 Pages 14

15 Trademarks IBMand WebSphere are trademarks of International Business Machines Corporation in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. Notes Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here. All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without notice. Consult your local IBM business contact for information on the product or services available in your area. All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Information about non-ibm products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, compatibility, or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. This presentation and the claims outlined in it were reviewed for compliance with US law. Adaptations of these claims for use in other geographies must be reviewed by the local country counsel for compliance with local laws. ~ prz 10/30/06 Pages 15