This chapter describes basic security features that you can implement with MTO. However, you can implement more extensive security through the use of the Enterprise Server External Security Facility. For details see Introduction to Enterprise Server Security.
MTO provides optional security for individual transactions and resources. It is off by default.
MTO controls access to transactions and resources through three mechanisms:
MTO also provides a mechanism for implementing your own password encryption and decryption strategy.
Transaction security allows you to control access to individual transactions.
To enable security for a transaction, you must do two things:
If you assign security key number 1 to a transaction, any user can run the transaction; all users own security key 1 by default. Figure 6-1 illustrates security key checking applied to a transaction.
Figure 6-1: Transaction key checking
You can control access by a transaction to the following types of resource:
To enable resource security, do the following:
Figure 6-2 illustrates the process of resource key checking.
Figure 6-2: Resource key checking
You must create an entry for the user in the Sign-on Table (SNT) if the user requires:
Each entry in the SNT specifies the following:
When you create a MTO Resource Definition File, its SNT already contains an entry for the system administrator, with username SYSAD and password SYSAD. (You must enter this password in upper case.)
User SYSAD has system administrator privileges and owns all security and resource keys.
You should change SYSAD's password to something more secure as soon as possible.
MTO calls a user-replaceable module, dfhucryp.gnt in location /$COBDIR/src/, to perform encryption and decryption of user passwords. The installed module does not actually perform any encryption; that is, the encrypted password is the same as the unencrypted password. You can replace this module with one that implements a password encryption and decryption strategy appropriate for your site.
An example module, dfhucry1.gnt, which implements a simple encryption and decryption scheme is supplied. Its source (.cbl) form is provided in the directory $COBDIR/src/directory. It uses the number of 1 bits in the user ID as a shift count and a pair of encipher and decipher tables.
The interface to dfhucryp.gnt is a standard call interface, requiring a single parameter:
CALL "DFHUCRYP" USING CRYPT-PARAMETER-AREA.
01 CRYPT-PARAMETER-AREA. 05 CRYPT-FUNCTION PIC XX COMP-X. 88 CRYPT-ENCRYPT-88 VALUE 1. 88 CRYPT-DECRYPT-88 VALUE 2. 05 CRYPT-RESULT PIC XX COMP-X. 88 CRYPT-SUCCESSFUL-88 VALUE 0. 88 CRYPT-FAILED-88 VALUE 1. 05 CRYPT-USER-ID PIC XX(8). 05 CRYPT-ENCRYPTED-PASSWORD PIC XX(8). 05 CRYPT-DECRYPTED-PASSWORD PIC XX(8).
where:
CRYPT-FUNCTION | Specifies the function as encrypt (=1) or decrypt (=2).
The encrypt function takes the decrypted password as input and outputs the encrypted password, possibly referring to the user ID field. The decrypt function takes the encrypted password as input and outputs the decrypted password, possibly referring to the user ID field. |
CRYPT-RESULT | This field is used to signal the success (=0) or failure (=1) of the function. Since a failure is treated as a password mismatch in all validation functions, the error return can be used to screen out unacceptable passwords during the SNT update process. |
CRYPT-USER-ID | The user ID associated with the password being encrypted or decrypted. |
CRYPT-ENCRYPTED-PASSWORD | The encrypted password. This field is used as an input field by the decrypt function and as an output field by the encrypt function. |
CRYPT-DECRYPTED-PASSWORD | The decrypted password. This field is used as an output field by the decrypt function and as an input field by the encrypt function. |
The only restrictions on the encryption and decryption scheme you choose are as follows:
You should bear in mind that the routine is called on entry to the resource definition maintenance functions and at every attempt to sign on to MTO. A slow scheme can, therefore, result in poor performance.
If you alter your password encryption and decryption scheme, any encrypted passwords stored in the Sign-on Table (SNT) must be decrypted using the old scheme and then re-encrypted with the new scheme. A utility program called dfhpcryp.gnt is supplied to assist in this conversion.
The procedure for moving to a new encryption scheme is described below. In this procedure, you introduce your new encryption module to the system as dfhucryu.gnt. You then run the dfhpcryp.gnt utility, which uses the existing module, dfhucryp.gnt, and your new one to perform the conversion. When the conversion is complete, you replace the existing module with your new one.
Before you make any changes, please take a backup copy of:
To run dfhpcryp.gnt:
Warning: Your new module must only replace the existing dfhucryp.gnt after the dfhpcryp.gnt has been run to perform the conversion.
MTO is now ready to run with the new encryption and decryption scheme.
The backups taken during this process are important in case you want to return to the old encryption and decryption scheme for any reason.
Copyright © 2006 Micro Focus (IP) Ltd. All rights reserved.