Certificate-based logon to zOS

DCAS (zOS Communications Server's Digital Certificate Access Server) has come to my rescue. From the docs:

The DCAS can be used by providers of logon and single sign-on services where access to z/OS-based applications is needed. The DCAS is a TCP/IP server that enables clients to connect over the network and obtain a passticket and z/OS user ID from RACF.

Clients that connect to DCAS must use the SSL protocol (DCAS supports SSL Version 3). Client authentication is performed.

Clients can request a user ID and passticket for an application. The client sends an x.509 certificate. DCAS converts the x.509 certificate to a valid user ID, which is returned. The x.509 certificate must have been mapped to a valid user ID in RACF

It's the second time in a few months that DCAS is the solution to the problem that I'm working on; unfortunately, I had forgotten about the first time, so it has taken my a while to get rescued. Not a complete waste of time: if learned a few things about PKI and RACF.

The first time it was about a service to generate passtickets (strings that can be used as passwords for a short while). Despite my recommendation, the customer's choice was to not use DCAS and code it from scratch; go figure.

Now it is about authenticating to RACF from a application that uses a smartcard reader. I'm looking forward to code the smartcard-based RACF logon, since working with smartcards has been in my wish list for very long.

And since google and DCAS don't seem to be big friends, I'm posting this.

Llibres en anglès a Barcelona

Vinc d'Hibernian Books, a Gràcia; està la mar de bé i m'he firat un parell de llibres:

• Applied Cryptography, de Bruce Schneier, per 7€
• The Peter Principle, per 4€. M'ha fet molta il·lusió, doncs l'havia llegit en castellà fa una pila d'anys, però ja fa molt que no sé on para.
  

M'han parlat molt bé de Elephant Book Store.

Intro to security on z/OS

I've just read a good article from the IBM Systems Journal: Security on z/OS: Comprehensive, current, and flexible. About 20 printed pages, from 2001, and written "at a high level, aimed at enterprise decision makers and application architects. The intent is to explain the comprehensive security componentry within z/OS and to show how these techniques and functions are exploited by modern distributed and Internet applications".

This is not mentioned in the article, but one thing that in the past has made me feel uneasy about z/OS security was the limited maximum password length (8 chars), giving a very small password-space by today's computing standards. No need to be concerned about this anymore: z/OS V1.8 supports RACF pass phrases from 14 to 100 characters in length.

I learned some neat things about the z/OS security capabilities that, as far as I know, are not available in other operating systems, e.g.

• access control can be made dependant on time.
• great separation of roles: admins can administer resources without having access to them, or admins cannot prevent the auditor from auditing them, while the auditors cannot authorize themselves to resources (Update: César Gustavo Miramontes, Domino for iSeries wizard, pointed to me that iSeries also has this capability).
  

The article mentions that the SSL performance has dramatically increased: from 13 SSL handshakes per second in 1998 to 2,000 in 2001. Likely to be old data, but this talks about 11,000 SSL handshakes/second.

Another introductory article that I liked is Ensuring Security On IBM Mainframes. Shorter (10 pages), but was useful for me to get a basic understanding of RACF classes and profiles.

More security-related goodies comming with z/OS v1.9; dear to me with what is keeping me busy today are support for PKCS#11 and a Java API for RACF administration.

Alice (heart) Bob

If Alice and Bob make you think in cryptography, you'll probably enjoy this strip: http://xkcd.com/c177.html

via Bruce Schneier's Crypto-Gram.