NOTE
TLSPORT
0 was an undocumented parameter. |
BlueZone Security |
Chapter 8 |
There are a few basic tasks which will be described in detail then are referenced in the various configuration scenarios. This document is based on z/OS 1.4 & 1.5. The program gskkyman is documented in System SSL Programming V1R4.0 SC24-5901-03 and an online copy of the document can be found at:
http://publibfp.boulder.ibm.com/cgi-bin/bookmgr/BOOKS/gska1a21/CCONTENTS
Enter the OMVS environment
Create a directory for all SSL objects and change to that directory
Enter the command: gskkyman
Option 1 – Create a new database
Enter a name for it like key.kdb
Enter a password twice
Enter a password expiration value
Enter database record length, use 2500
Option – 10 to save the database password in a file,
Database is ready for use
Option 6 – Create a Self-signed Certificate
Select one of the CA certificate types like 1 – CA with 1024 RSA key
Enter a label like: SigningCA
Enter certificate information:
Common name like Signing Certificate
Organization Unit like Seagull Software
Organization like PD
City
State
Country
Number of days certificate will be valid (1 – 9999)
Option 1 – Manage Keys and Certificates
Select SigningCA
Option 7 – Export Certificate and Key
Option 3 or 4 PKCS #12 version 3
File name SigningCA.p12
Enter password twice
Enter 0 for export encryption
Change to your PC
FTP the p12 file to the PC using Binary if option 3 was used to export or ASCII is option 4 was used.
Open a browser like IE:
Tools->Internet Options…
Contents tab
Certificates button
Import…
Next
Select file that was FTP'ed to the PC
Next
Enter certificate password and select Mark this key as exportable checkbox.
Next
Place in Trusted Signing store
Next
Finish
Option 4 – Create New Certificate Requests
Select one of the certificate types like 1 – CA with 1024 RSA key
Request file name like Server.arm
Enter certificate information:
Common name like Server Certificate
Organization Unit like Seagull Software
Organization like PD
City
State
Country
Exit gskkyman
Sign the request by issuing:
gskkyman -g -x 360 -cr Server.arm -ct Server.cer -k yourkey.kdb
Enter yourkey.kdb password
gskkyman
Option 2 – Open Database
Yourkey.kdb
Enter password
Option 5 – Receive Requested Certificate
Enter the name of the certificate: Server.cer
Option 4 – Create New Certificate Requests
Select one of the certificate types like 1 – CA with 1024 RSA key
Request file name like Client.arm
Enter certificate information:
Common name like Client Certificate
Organization Unit like Seagull Software
Organization like PD
City
State
Country
Exit gskkyman
Sign the request by issuing:
gskkyman -g -x 360 -cr Client.arm -ct Client.cer -k yourkey.kdb –l SigningCA
Enter yourkey.kdb password
gskkyman
Option 2 – Open Database
Yourkey.kdb
Enter password
Option 5 – Receive Requested Certificate
Enter the name of the certificate: Client.cer
Option 1 – Manage Keys and Certificates
Select Client
Option 7 – Export Certificate and Key or Option 6 – No Key
Option 3 or 4 PKCS #12 version 3 (if option 6 it will be PKCS #7)
File name Client.p12
Enter password twice
Enter 0 for export encryption
Change to your PC
FTP the p12 file to the PC using Binary if option 3 was used to export or ASCII if option 4 was used.
Open a browser like IE:
Tools->Internet Options…
Contents tab
Certificates button
Import…
Next
Select file that was FTP'ed to the PC
Next
Enter certificate password and select Mark this key as exportable checkbox.
Next
Place in Personal store
Next
Finish
In BlueZone Open the Configuration dialog:
On the MenuBar select Session:Configure:Configure
Select the Security tab and check the Enable Secure Sockets Layer checkbox
Select SSL v3
Select the Certificate tab and select Client Certificate in Disk File
Browse and select Client.p12 file
FTP Client.p12 back as an MVS dataset
Go back to the mainframe
Go to ISPF 6 to enter a TSO command
Enter the RACF command:
RACDCERT ID(USERID) ADD('USERID.CLIENT.P12') TRUST WITHLABEL('Client') PASSWORD(‘xxxxxxxx’)
Follow - Create an HFS KEYRING File
Follow - Create a Self-signed Certificate if a Trusted CA is Not Available
Follow - Create a Server Certificate
OMVS change to your SSL directory
gskkyman
Option 2 – open database
Enter your database name
Enter password
Option 1 – Manage keys
Select the Server Certificate
Option 3 – Set key as default
Add the following to TCPIP.PROFILE:
TelnetParms
SECUREPORT 992
KEYRING HFS /ssl/key.kdb
SSLTIMEOUT 120
EndTelnetParms
Follow - Create an HFS KEYRING File
Follow - Create a Self-signed Certificate if a Trusted CA is Not Available
Follow - Create a Server Certificate
Follow - Create a Client Certificate
Add the following to TCPIP.PROFILE:
TelnetParms
SECUREPORT 992
KEYRING HFS /ssl/key.kdb
CLIENTAUTH SAFCERT
SSLTIMEOUT 120
EndTelnetParms
Steps 1 – 3 were done for telnet
Modify the FTP configuration dataset, ie. TCPIP.FTP.DATA and add:
EXTENSIONS AUTH_TLS
SECURE_LOGIN NO_CLIENT_AUTH
TLSTIMEOUT 500
KEYRING /ssl/key.kdb
SECURE_CTRLCONN PRIVATE
SECURE_DATACONN PRIVATE
SECURE_FTP REQUIRED
TLSPORT 0
NOTE
TLSPORT
0 was an undocumented parameter.
Steps 1 – 4 were done for telnet
Modify the FTP configuration dataset, ie. TCPIP.FTP.DATA and add:
EXTENSIONS AUTH_TLS
SECURE_LOGIN VERIFY_USER
TLSTIMEOUT 500
KEYRING /ssl/key.kdb
SECURE_CTRLCONN PRIVATE
SECURE_DATACONN PRIVATE
SECURE_FTP REQUIRED
TLSPORT 0
NOTE
This configuration
has not been attempted *
Follow - Create an HFS KEYRING File
Follow - Create a Self-signed Certificate if a Trusted CA is Not Available
Follow - Create a Server Certificate
Follow - Create a Client Certificate
Add EXPRESSLOGON to the TelnetParms block
SETR CLASSACT(PTKTDATA)
RDEF PTKTDATA TSOSYS1 SSIGNON(KEYMASKED(E001193519561977)) UACC(NONE) APPLDATA(‘NO REPLAY PROTECTION’)
KEYMASKED can be any combination of 16 hexadecimal characters.
TSOSYS1 is TSO concatenated with the value of SID in SMFPRMxx if VTAM generic resource naming is not being used. If VTAM generic resource naming is being used, see z/OS V1R4.0 Security Server RACF Security Administrator’s Guide, 7.13.3.1 Determining Profile Names.
A passticket expires in 10 minutes, to make it expire after signing on add: APPLDATA(‘NO REPLAY PROTECTION’).
Follow - Create an HFS KEYRING File
Follow - Create a Self-signed Certificate if a Trusted CA is Not Available
Follow - Create a Server Certificate
NOTE
When creating
the Server Certificate, the label name needs special attention. It
is not required but it is better to name the label the same as the starting
point of the host name: https://cics14.seagullsoftware.com would have
a label of cics14. If
both are named the same it will eliminate a dialog box when the URL is
accessed.
On the PC
Locate the Signing CA certificate on the PC and FTP it to the mainframe using binary or ASCII depending on which option was used when it was exported. FTP to an MVS dataset.
On MVS go to ISPF option 6, ISPF Command Shell and issue the RACF commands:
RACDCERT ID(CICS USERID) ADDRING(RINGNAME)
RACDCERT ID(CICS USERID) CONNECT(CERTAUTH LABEL(‘Signing CA label’) RING(RINGNAME))
RACDCERT ID(CICS USERID) CONNECT(LABEL(‘Server label’) RING(RINGNAME))
Edit the CICS SIP file:
ENCRYPTION=NORMAL, (56 bit) =STRONG (168 bit),
KEYRING=RINGNAME,
SSLDELAY=600,
SSLTCBS=8,
Change the CICS startup JCL making sure the SSL SGSKLOAD data set is available by means of the STEPLIB, JOBLIB unless it is listed the LNKLST IPL parameter.
For the CICS TCPIPSERVICE resource
Set the port number. 684 is the well known port
Set the SSL property to YES
Follow SSL for CICS Using Server Certificate
RACDCERT ID(CICS USERID) CONNECT(LABEL(‘Client label’) RING(RINGNAME))
For the CICS TCPIPSERVICE resource
Change the SSL property to CLIENTAUTH
Set Certificate to the label of the Client Certificate