XYGATE Access Control Reference Manual

ManualsBrandsHP ManualsServerHP NonStop G-Series

XYGATE

Access Control Reference Manual

HP Part Number: 657928-002

Published: September 2013

Edition: J06.03 and subsequent J-series RVUs. H06.03 and subsequent J-series RVUs. G06.10 and subsequent G-series RVUs.

Summary of content (320 pages)

PAGE 1
® XYGATE Access Control Reference Manual HP Part Number: 657928-002 Published: September 2013 Edition: J06.03 and subsequent J-series RVUs. H06.03 and subsequent J-series RVUs. G06.10 and subsequent G-series RVUs.
PAGE 2
PAGE 3
© Copyright 2013 Hewlett-Packard Development Company, L.P Legal Notice Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor’s standard commercial license. The information contained herein is subject to change without notice.
PAGE 4
Publication History Software Ver. 5.60 Description Date Reformatted for new template, re-arranged chapters and appendices. May 2011 5.65 Refer to the Softdoc; added “Publ. History” page; updated address. Mar. 2012 5.70 Added list of ACCONF file keywords in App. A1: added OSSXAC macro in App. E2: updated ACL IDs limit to 20,000 from 10,000 in App. C2: updated descriptions for the USER_SWITCH keyword in Apps. A33:and C91: Jul. 2012 5.
PAGE 5
CONTENTS Introduction ............................................................................................. xv Security on the HP NonStop Platform ................................................. xv The XYGATE Access Control Solution ................................................. xv Vocabulary ...............................................................................xvii XAC Installation Design Philosophy ...................................................
PAGE 6
XYGATE® Access Control Reference Manual Contents Chapter 2. Chapter 3. Chapter 4. Chapter 5. Configuring XAC .........................................................................29 2.1 Creating 2.1.1 2.1.2 2.1.3 2.1.4 New Command Entries ............................................... 29 ACCONF................................................................ 29 ACACL.................................................................. 29 ACACL Command Entries in the ACACL File ......................
PAGE 7
XYGATE® Access Control Reference Manual Contents Chapter 6. EMS Message Format Templates .....................................................59 6.1 Chapter 7. Chapter 8. Procedure ......................................................................... 59 XAC Auditing and Audit Reports......................................................63 7.1 AUDIT File Considerations ...................................................... 63 7.1.1 AUDIT File Creation...............................................
PAGE 8
XYGATE® Access Control Reference Manual Contents A13: EMS_CRITICAL_IF_DENIED ......................................................103 A14: HIGHPIN ..........................................................................103 A15: HOMETERM .......................................................................104 A16: IPMAP .............................................................................104 A17: MACRO_NAME ....................................................................104 A18: MONITOR ...
PAGE 9
XYGATE® Access Control Reference Manual Contents C5: ALIAS ..............................................................................149 C6: ALIAS_ALL_PROCESSES..........................................................150 C7: ALIAS_OSS_PROCESSES .........................................................150 C8: ALIAS_XYGATEAC_PROCESSES .................................................151 C9: ALLOWCMD .......................................................................
PAGE 10
XYGATE® Access Control Reference Manual Contents C40: IGNORECONNECT ................................................................181 C41: INPUT .............................................................................182 C42: JOBID .............................................................................183 C43: LOWPIN ...........................................................................183 C44: MAP_B_FKEY .....................................................................
PAGE 11
XYGATE® Access Control Reference Manual Contents C75: SHUTDOWN_MESSAGES .........................................................207 C76: SISO ...............................................................................207 C77: STARTUP ..........................................................................208 C78: START_LOGGED_OFF............................................................210 C79: START_LOGGED_ON.............................................................211 C80: STOPIFAUDITERROR ..
PAGE 12
XYGATE® Access Control Reference Manual Contents D15: <XAC_AUDIT_OUTPUT ..........................................................244 D18: >XAC_CHANGE_VOLUME ........................................................245 Appendix E: XAC Host Macros ......................................................................
PAGE 13
XYGATE® Access Control Reference Manual Contents Appendix F: XAC Obey and Command File Use and Token Replacement .................. 277 Appendix G: XAC Error Messages ................................................................... 279 Index ...........................................................................................
PAGE 14
XYGATE® Access Control Reference Manual Contents XYPRO Technology Corporation xiv Proprietary and Confidential
PAGE 15
Introduction Welcome to the XYGATE Access Control product security software from XYPRO Technology Corporation for the HP NonStop™ server. Security on the HP NonStop Platform System and application security on the HP NonStop platform has evolved over the years. In 1977, when the NonStop operating system was introduced, security was based totally on logons (with unencrypted passwords!), crude diskfile permissions and privileges inherent in specific userids such as SUPER.SUPER and *.MGR.
PAGE 16
XYGATE® Access Control Reference Manual Introduction XAC functions with or without Safeguard. If Safeguard is used, XAC interfaces with it for all security features implemented in Safeguard. If Safeguard is not present, XAC just as easily uses NSK basic security. With XAC, you can do the following: • Audit all user activity on the NonStop server in Guardian or OSS modes or just pre-defined sensitive actions. • Eliminate all shared userid use. • Eliminate SUPER.SUPER as a shared userid.
PAGE 17
XYGATE® Access Control Reference Manual Introduction Vocabulary XAC is the name of the XYGATE Access Control software package. XYGATEAC is the name of the object file that runs as a process to manage an XAC session. XAC by itself is the name of the macro that is run to perform two functions: (1) attach the XAC_SEG compiled TACLSEG library of macros, and (2) invoke XYGATEAC to start an XAC session. DBSO is the name of the object file that runs as the database server.
PAGE 18
XYGATE® Access Control Reference Manual Introduction Most XAC installations chart a course between the two extremes described above, with a mix of secured, audited TACLs for some situations, and XAC Command Entries for individual commands to be secured. The following sections describe some of the elements of these two endpoints of the XAC installation spectrum.
PAGE 19
XYGATE® Access Control Reference Manual Introduction PASSONTIMEOUT OFF DONOTSTOP $SYSTEM.SYSTEM.PATHTCP2 OPENSBYOBJECTS \*.$*.*.* TRACKUSERID START_LOGGED_OFF COMMAND SAFEGUARD-TACL OBJECT $SYSTEM.SYSNN.TACL USER GROUP,USER ACL \*.*,* ALIAS:"\*.*" START_LOGGED_ON PERCENT OFF NULLNULLSTOP EXECUTEHANGUP CHECKCONNECTION 750 350 STOPONERROR 60,66,140,190,191 PASSONTIMEOUT OFF OPENSBYOBJECTS \*.$*.*.
PAGE 20
XYGATE® Access Control Reference Manual Introduction *Type................... *Display................ *Owner.................. *CPU.................... *Swap................... *Program................ *Lib.................... *Resilient.............. *Param.................. *Assigned Window........ *Default Service........ LINE $ZTNP2 5-> CONVERSATION *Subtype................ ON *Autodelete............. N/A *Access................. N/A *Pri....................
PAGE 21
XYGATE® Access Control Reference Manual Introduction PARAM-TEXT = * NONE * (255,255)-3 = ALTER TERMINAL $MYTERM,PROG $SYSTEM.XYGATEAC.XYGATEAC,PARAM-TEXT SAFEGUARD-TACL (255,255)-4 = INFO TERMINAL $MYTERM TERMINAL $MYTERM STATUS FROZEN PROG = $SYSTEM.XYGATEAC.
PAGE 22
XYGATE® Access Control Reference Manual Introduction *Type................... CONVERSATION *Subtype................ DYNAMIC *Display................ ON *Autodelete............. OFF *Owner.................. SUPER.SUPER *Access................. SYSTEM *CPU.................... 1 *Pri.................... 150 *Swap................... $DISCA *Program................ $SYSTEM.SYSTEM.OSH *Lib.................... N/A *Resilient.............. OFF *Param.................. N/A *Assigned Window........
PAGE 23
XYGATE® Access Control Reference Manual Introduction Special Purpose TACLs There are two kinds of special purpose TACLs. The first permits users to execute all their functions under a TACL running as a different userid without the user having any knowledge of the password to that userid. This approach is most commonly used when the operating environment requires a single defined userid to perform all the tasks. One example of this might be an environment that has been built assuming that PROD.
PAGE 24
XYGATE® Access Control Reference Manual Introduction Individual XAC Command Entry An individual XAC Command Entry is designed to start a Guardian utility, third-party application or user-supplied program with a PAID of a specified userid. There is an object file to be executed and there are restrictions on who can execute the Command Entry. Additional keywords can be used to control other aspects such as subcommands that can be executed, timeouts and auditing. Example: COMMAND SCF-255 OBJECT $SYSTEM.
PAGE 25
XYGATE® Access Control Reference Manual Introduction ALLOWCMD "INFO " ALLOWCMD "EXIT " ALLOWCMD ">" ALLOWCMD RE:".*$DEV1|$DEV2.*" DENYCMD * The additional keywords that control FC are required by the ALLOWCMD and DENYCMD. The ALLOWCMD/DENYCMD set permits only INFO, EXIT, XAC Internal Commands and any other command that has $DEV1 or $DEV2 in it, thereby denying commands that access any other line. ACACL Command Entries are described in more detail in Appendix C: starting on page 138.
PAGE 26
XYGATE® Access Control Reference Manual Introduction • New – ACACL keyword ALIAS_XYGATEAC_PROCESSES in Appendix C8: on page 151. • New – ACACL keyword BREAK_DISABLE_RETURN in Appendix C20: on page 162. • New – ACACL keyword USER_IGNORED in Appendix C89: on page 218. • New – ACACL keyword WRITEREAD_ALWAYS in Appendix C93: on page 228.
PAGE 27
XYGATE® Access Control Reference Manual Introduction [ ] Brackets. Brackets enclose optional syntax items. For example: TERM [\.]$ INT[ERRUPTS] A group of items enclosed in brackets is a list from which you can choose one item or none. The items in the list may be arranged either vertically, with aligned brackets on each side of the list, or horizontally, enclosed in a pair of brackets and separated by vertical lines.
PAGE 28
XYGATE® Access Control Reference Manual Introduction Item Spacing. Spaces shown between items are required unless one of the items is a punctuation symbol such as a parenthesis or a comma. For example: CALL STEPMOM ( ) ; If there is no space between two items, spaces are not permitted. In the following example, there are no spaces permitted between the period and any other items: $.
PAGE 29
Chapter 1. Installing XAC This chapter describes installing or upgrading the XYGATE XAC files, updating the XYGATE licenses and then guides you through the process of securing your installation. Running the AutoInstall script is a guided installation with minimal SUPER command line input except where noted. 1.1 Before You Begin Ensure that you have the following information ready before you begin the installation procedures: 1.2 • Administrator privileges for your PC.
PAGE 30
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC User-Defined Configuration Values Required for AutoInstall You have the option of specifying the user-defined values shown in Table 1 when using the AutoInstall script. If you do not specify a value, AutoInstall will use default values given in Table 2. If necessary, contact your system manager for input to these questions.
PAGE 31
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Table 3 defines default configuration values and file locations that will be generated automatically by the AutoInstall script. Table 3: AutoInstall-Assigned Default Values or Locations Config File Configuration Settings Default Values Assigned by AutoInstall Script or Locations A staging subvolume for installation only. May be removed after installation has been completed.
PAGE 32
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Config File Configuration Settings Default Values Assigned by AutoInstall Script or Locations TRCONF XTR option TR_MASTER_SUBVOL $VOL.XYGATETR TRCONF XTR encryption options OFF TRCONF XTR SSL options OFF TRCONF XTR monitor/debug options OFF TRACL XTR/XAC $OWNER Authorized users OWNER running the script + SUPER.SUPER TRACL XTR option TR_INSTALLATION IP address and Port Number 1.2.
PAGE 33
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC In the above example, $DAT90 is accepted as the default XTR volume. Script prompts will return an error to the screen if the entered value is not valid. You can then change your response to a valid entry. Example: Enter XTR volume <$DAT90>? Zmywrk Invalid volume entry, try again Invalid response You can end the script by pressing Ctrl+Y at any prompt. Stopping the script will end the install or upgrade prematurely.
PAGE 34
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC 5. Obey the file IXYBIN to unpack program files and prepare them for the automated install script. Syntax: $MYVOL ZXYPROAC 4> OBEY IXYBIN Example: $MYVOL ZXYPROAC 4> OBEY IXYBIN The installation begins by unpacking the self-extracting IXYBIN file containing the files and programs distributed in the DSV. Note that the three vertical dots inserted below indicate that output is omitted for brevity in this manual only.
PAGE 35
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC IWIZARD, the installation process will continue from the point where it was stopped. Are you ready to continue ? Y The AutoInstall script will attempt to locate any installed XTR environments and will display these located environments as shown below. If you are running this script to upgrade one of these environments, refer to section 1.3, “Upgrading XAC and/or XTR Using the AutoInstall Script” starting on page 11.
PAGE 36
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Discovering XAC ($*.*) ... Discovery complete. SEL --1) LOCATION VERSION OWNER AVAILABILITY ----------------- ------- ----------------- -----------$VOL.JIM XYPRO.JAMES Available P) Prompt for new location Available Press BREAK or -Y to exit. Enter available selection: If this is a first-time installation, one of the following will be true: • No existing installed environments will be displayed.
PAGE 37
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC If this is a new install, you will be asked for any additional users/aliases (90-characters max.) that you may want to have access to this environment. The AutoInstall script will add any additional users to the access list for this environment. Enter user id's, separated by spaces <>? Enter aliases, separated by spaces <>? If this is a new install, you will be asked for a port number.
PAGE 38
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Are you ready to continue ? Y Establishing product locations ... Product locations established. Performing verifications ... Verifications complete. Installing products: Install of products complete. Performing products syntax check ... Products syntax check complete. Verifying XAC is listed in XTR TRACL file ... Done verifying XAC is listed in XTR TRACL file. XYGATE GUIs use a LISTNER process to connect to the host.
PAGE 39
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC ----------------------------------------------------------------Validation finished. If no errors were reported, and the information shown was as expected, the installation was validated. ----------------------------------------------------------------- This ends the AutoInstall installation of the XAC files. 1.
PAGE 40
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC If you know the location of the initial installation staging subvolume, overwrite that using the PURGE option of FUP. This will ensure that the installed environments are correctly upgraded to the most current product. Syntax: $MYVOL IXYPROAC 3> FUP DUP <$VOL>.ZXYPROAC.* EXCLUDE Z*,<$VOL>..*,PURGE,SAVEALL Example: $MYVOL IXYPROAC 3> FUP DUP $DSCSCM.ZXYPROAC.* EXCLUDE Z*,$MYVOL.IXYPROAC.
PAGE 41
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Initializing config file ... Done initializing config file. Warning: Access to SUPER.SUPER (or an alias to SUPER.SUPER) may be required to complete the installation of each XYGATE product. During the installation, if the need for SUPER.SUPER arises, the installation will be paused and the user will be asked to issue specific commands from another TACL prompt while logged on as SUPER.SUPER (or an alias to SUPER.
PAGE 42
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC The AutoInstall script will attempt to locate any already installed XAC environments and display these located environments as shown below. Discovering XAC ($*.*) ... Discovery complete. SEL --1) 2) LOCATION VERSION OWNER AVAILABILITY ----------------- ------- ----------------- -----------$VOL.JIM XYPRO.JAMES Available $VOL.XYGATEAC 5.65 XYPRO.JAMES Available P) Prompt for new location Available Press BREAK or -Y to exit.
PAGE 43
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC go to another TACL session, logon as SUPER.SUPER or an alias of SUPER.SUPER, and license these files. You may continue when this has been done. If you decide not to continue, the next time the wizard is run, the wizard will continue where you last stopped. To license these files, enter the following commands: FUP LICENSE $VOL.P46DSDST.IADOPTN4 Are you ready to continue ? Do not answer the above prompt yet.
PAGE 44
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Start another TACL session using a SUPER.SUPER logon, and perform the licensing tasks as directed by the script. The specific licensing instructions vary depending on which products were installed or upgraded. Licensing requirements are to be performed by a SUPER.SUPER logon for XTR only: Example: TACL> RUN $VOL.XYGATETR.XTR INSTALL TACL> XTR_FINISH_INSTALL Licensing $VOL.XYGATETR.ADOPT Licensing $VOL.XYGATETR.
PAGE 45
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC 1.3.3 Running AutoInstall to Upgrade XAC Only Access to SUPER.SUPER (or an alias to SUPER.SUPER) will be required during the upgrade to perform necessary licensing tasks in a separate TACL session. This requirement will be indicated by the AutoInstall script and is also documented in this procedure. Note: The AutoInstall script waits on a prompt while the user starts a separate TACL session when requested to perform specific actions.
PAGE 46
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC SEL --1) LOCATION VERSION OWNER AVAILABILITY ----------------- ------- ----------------- -----------$VOL.XYGATETR 1.56 XYPRO.JAMES Available P) Prompt for new location Available Enter available selection: Select an existing XTR installation by providing the selection number. Only environments that are owned by your userid are available to be upgraded. Other environments are shown for information only.
PAGE 47
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Verifications complete. Installing products: If the installed software is older than the current version, the script will notify you and perform the upgrade. Upgrading the XAC software requires licensing of one of the installation programs to perform this function. Comparing installed version of XAC to available version ... A higher version of XAC was found. XAC will be upgraded. Installing XAC from \N1.$VOL.ZXYPROAC ...
PAGE 48
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Installing products: Install of products complete. Verifying XAC is listed in XTR TRACL file ... Done verifying XAC is listed in XTR TRACL file. Taking inventory ... Taking inventory complete. Validating the installation ... A final status screen will display the current XAC environment. Product -------XAC XTR Distribution Version -------------------5.65 1.56 Installed Version ----------------5.65 1.
PAGE 49
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC IWIZARD, the installation process will continue from the point where it was stopped. Are you ready to continue ? Y The AutoInstall script will attempt to locate any already installed XTR environments and display these located environments as shown below. Establishing product locations ...
PAGE 50
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC Press BREAK or -Y to exit. Enter available selection: Choose the number (under the SEL heading) of an existing environment. Only environments that are owned by your userid are available for selection. Other environments are shown for information only. Enter available selection: 2 Updating config ... Config updated. Product locations established. Performing verifications ...
PAGE 51
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC FUP LICENSE $VOL.P46DSDST.IADOPTN4 Are you ready to continue ? Do not answer the above prompt yet. Start a separate TACL session using a SUPER.SUPER logon, and perform the necessary licensing tasks as shown in the Example below. Example: TACL> FUP LICENSE $VOL.P46DSDST.IADOPTN4 TACL> Logoff as the SUPER.SUPER or SUPER alias When you complete the licensing tasks, answer Y to the prompt below to continue.
PAGE 52
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC When you complete the licensing tasks, answer Y to the prompt below to continue. Are you ready to continue ? Y Establishing product locations ... Product locations established. Performing verifications ... Verifications complete. Installing products: If the installed software is older than the current version, the script will notify you and perform the upgrade.
PAGE 53
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC 1.4.1 Preparing for the Auto Uninstall Script The Auto Uninstall script will attempt to uninstall all modules that are running on the server as follows: • Uninstall the XYGATEAC installed product software. • Uninstall the XYGATETR installed product software. • Stop the LISTNER process for the connection of GUI products to XYGATETR. 1. Locate the installation subvolume where the XAC product AutoInstall script was executed.
PAGE 54
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC If you wish to uninstall these XAC and XTR environments, enter Y to continue. The uninstall process takes a few minutes to complete. Are you ready to continue ? Y Working ... Detaching segment ... Removing XTR Installed files Removing XAC Installed files Checking results ... Done. 1.5 on \N1.$VOL.XYGATETR ... on \N1.$VOL.XYGATEAC ...
PAGE 55
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC You can also check your current license using the XAC_VERSION macro described in Appendix E23: on page 273 as shown in the abbreviated output below. Example: $VNEO1 XYGATEAC 62> xac_version This is version 5.
PAGE 56
XYGATE® Access Control Reference Manual Chapter 1. Installing XAC 1.7 Securing XYGATEAC This section describes how to secure the XYGATE XAC module. Note that the SECURITY.ADMIN userid is assumed to be the “owner” of the XYGATE XAC software. If a different userid is used, then adjust these security settings accordingly. Also note that the XYGATE XAC software is assumed to be installed on $SYSTEM.XYGATEAC. Adjust these security settings if different values are used.
PAGE 57
Chapter 2. Configuring XAC This chapter describes the procedures for configuring XAC by creating new command entries and modifying the ACCONF and ACACL files. 2.1 Creating New Command Entries XAC is delivered with a sample ACCONF and ACACL fileset that provides a minimum level of functionality. This chapter describes how to change these two files and how you can develop your own commands. 2.1.1 ACCONF The ACCONF file configures how XAC functions.
PAGE 58
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.1.3 ACACL Command Entries in the ACACL File This table describes some of the commands included in the initial ACACL file. Command Name Purpose TACL-255 Starts a copy of TACL that runs under the userid 255,255. The users that are permitted to use this TACL are listed in the ACLGROUP profile for $SUPER. TACL-ASYNCH Starts a copy of TACL that the user must logon to using a valid userid and password.
PAGE 59
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.1.4 How to Build an ACACL Command Entry This section describes how to build an ACACL Command Entry. 2.2 1. Determine which program you will be executing. 2. Determine if you want the program to run as the userid of the user who starts the session or if you want it to run as a specific userid. 3. Make a list of which users and aliases will need access to this XAC command. 4.
PAGE 60
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC Network users can also use XAC with the simple addition of a node name on the ACACL Command Entry name: \XYPRO.$SYSTEM.MYSUBVOL 28> XAC \XYS7000.SPOOLCOM-254 JOB 1265,START This invocation of the XAC macro will execute the XYGATEAC program on the \XYS7000 node with results similar to that which a user would get if a TACL was started on \XYS7000, logged on as the “254” user, and then SPOOLCOM JOB 1265,START, was executed at the TACL prompt.
PAGE 61
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC Important! The process (usually the User’s TACL) which executes the XYGATEAC program, must be a named process in order for XYGATEAC to validate that a NonStop Kernel level authentication was accomplished by the user.
PAGE 62
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC USER 255,255 OBJECT $SYSTEM.SYSNN.FUP ACL $SUPER FC? FCPROMPT "-" TIMEOUT 900 PASSWORDTIMEOUT 600 PROMPT "'(',PAID,')',FC#" COMMAND SPOOLCOM-255-DP ! This command is used to execute SPOOLCOM as SUPER.SUPER via DP DESCRIPTION "SPOOLCOM as SUPER.SUPER via DP" USER 255,255 ! Execute as SUPER.SUPER OBJECT $SYSTEM.SYSTEM.SPOOLCOM ! ACL QA.IK ! Only the privileged user QA.
PAGE 63
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC sp255 JOB (LOC #XAC) ^ *ERROR* Name of variable, builtin, or file needed $VIK IK 61> $VIK IK 61> Example 5: XAC timeout $VIK IK 61> pshow fp255 XAC - $VIK IK 62> $VIK IK 62> pinfo /detail/ fp255 Name Program Process File Input Output Ready Wait History Prompt FP255 XYGATEAC STOPPED EMPTY 1 NO YES YES NO $VIK IK 63> $VIK IK 63> fp255 info tacl* pstart: starting $VIK.XAC575.
PAGE 64
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.6.2 –A Option The -A option will cause the ancestor chain to be searched for the most recent process in the ancestor chain that was authenticated by the entry of a password during logon. This is used with nested XAC sessions where the userid authentication has to be against the original user’s logon rather than the userid of any XYGATEAC session that the user might be using at the moment.
PAGE 65
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.7 Configuring XAC Userids and Aliases All XYGATE modules use standard Guardian userids and Safeguard aliases. No XYGATE module requires that you create a new user database. XAC allows you to enter userids as either user names or user numbers, but the two are treated somewhat differently according to the following: • If a user number is entered, XAC will not check for the presence of the userid on that node.
PAGE 66
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC You can use an asterisk ( * ) in either the GROUP position or the MEMBER position. And userids can include node names (or an asterisk to represent all nodes) when appropriate, as follows: *.* represents all local userids. \*.*.* represents all network userids. \NODEA.*.* represents all userids on \NODEA.
PAGE 67
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.7.2 Aliases Aliases are specified as follows: Syntax: ALIAS:"[\NODE.]" The ALIAS:" " syntax tells XYGATE (and the HP NonStop server) that the string is an alias. The quotation marks are necessary to prevent the string from being upshifted or TACL trying to interpret any special characters. You may use wildcarding to specify both nodes and alias names when appropriate. ALIAS:"*" represents all local aliases. ALIAS:"\*.
PAGE 68
XYGATE® Access Control Reference Manual Chapter 2.
PAGE 69
XYGATE® Access Control Reference Manual Chapter 2. Configuring XAC 2.7.4 The Concept of the Current Invoking User You need a way to tell XAC to use the current user’s userid or alias regardless of who it is at the moment, when it evaluates access to processes, utilities. Otherwise, you would be unable to grant any user access to his or her own objects without creating a separate rule for every user. Obviously, this is unworkable; hence, the keyword GROUP.USER.
PAGE 70
XYGATE® Access Control Reference Manual Chapter 2.
PAGE 71
Chapter 3. Node-Conditional Processing in the ACACL File All XYGATE products have a file that defines the security rules supported by the product. There is an ACACL file per product per node. In many HP NonStop server networks, the ACACL file for any given product will almost be the same for every or almost every NonStop server in the network. Rather than maintain many individual files, it is more convenient to maintain one master file and then duplicate that master file to every installation.
PAGE 72
XYGATE® Access Control Reference Manual Chapter 3. Node-Conditional Processing in the ACACL File LIKE Use LIKE when you wish to wildcard the names of nodes to include. You must use regular expression style wildcarding. Refer to the XYGATE Regular Expressions manual (refer to “Additional XYPRO Reference Manuals” in the “Introduction” for the instructions on how to get this and other XYPRO manuals).
PAGE 73
XYGATE® Access Control Reference Manual Chapter 3. Node-Conditional Processing in the ACACL File 3.2 Node Names or Patterns The node name can be specified as an exact node name (including the leading backslash), or as a wildcarded pattern, using simple NonStop server-supported wildcards or regular expressions.
PAGE 74
XYGATE® Access Control Reference Manual Chapter 3. Node-Conditional Processing in the ACACL File Example 1 shows how to simplify things if, due to a merger, the ID used to administer security is different on some nodes. In this situation, you can use an ACLGROUP with node-conditionals to designate the appropriate IDs on each node. If you then use the ACLGROUPs in FOGROUPs, PCGROUPs, HEGROUPs, etc.
PAGE 75
XYGATE® Access Control Reference Manual Chapter 3. Node-Conditional Processing in the ACACL File !Selection Criteria: USER $DBA !\*.200,* (DBA's) #IF @NODE LIKE "\\PROD.*" MASK RE:"^\$S1D[0-9][0-9]\.DAT[RPB]064\..*" RE:"^\$S1D[0-9][0-9]\.EG.*\..*" #ENDIF #IF @NODE LIKE "\\DEV.*" MASK RE:"^\$D1V[0-9][0-9]\.DAT[RPB]064\..*" RE:"^\$D1V[0-9][0-9]\.EG.*\..
PAGE 76
XYGATE® Access Control Reference Manual Chapter 3.
PAGE 77
Chapter 4. DBSO – The Database Server The DBSO Database server serves two functions in the XAC installation. As a running process, it provides command information to each new XAC session. Run with an ACACL filename or an ACCONF filename and keywords, it is limited to a single pass through these files, performing a variety of syntax and statistic checks. Every time DBSO reads the ACCONF, ACCONFCO or ACACL files, it generates a cryptographic checksum of the file. 4.
PAGE 78
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server 4.2 DBSO for Syntax and Statistics When DBSO is run with any of the optional keywords or with an alternative ACACL or ACCONF filename, it runs in a single pass, displaying any syntax errors found and optionally displaying a variety of statistics.
PAGE 79
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server The XAC macro XAC_SYNTAX_CHECK in the following example performs the same syntax check: Example: $SYSTEM.XYGATEAC 20> xac_syntax_check XYGATEAC 5.75 XYPRO \N1 20991231 (see >CONFIG for Copyright) ACCONF CHECKSUM 1651907125 ($SYSTEM.P06QA.ACCONF) ACACL CHECKSUM 995061119 ($SYSTEM.P06QA.ACACL1) No syntax errors found 4.2.
PAGE 80
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server The XAC macro XAC_STATS performs the same check as in the following example: Example: $VDEL DENNIS 2> XAC_STATS XYGATEAC 5.75 XYPRO \N1 20991231 (see >CONFIG for Copyright) ACCONF CHECKSUM 393627197 ($VNEO2.XAC570.ACCONF) ACACL CHECKSUM 843002451 ($VNEO2.XAC570.
PAGE 81
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server 4.2.3 DSTATS The DSTATS command displays the overall counts for the ACACL file and the individual message size for each individual entry as in the following example: Example: $VNEO2 XAC575 5> RUN DBSO DSTATS XYGATEAC 5.75 XYPRO \N1 20991231 (see >CONFIG for Copyright) ACCONF CHECKSUM 393627197 ($VNEO2.XAC570.ACCONF) ACACL CHECKSUM 843002451 ($VNEO2.XAC570.
PAGE 82
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server There are 10 individual command entries in the ACACL file. Three have a message length of 3766 bytes. The largest message size in the file is 4076 bytes. The maximum size of the message allowed is 16K bytes. The XAC macro XAC_DSTATS displays the same information as in the following example: Example: $VNEO2 XAC575 7> XAC6_DSTATS XYGATEAC 5.75 XYPRO \N1 20991231 (see >CONFIG for Copyright) ACCONF CHECKSUM 393627197 ($VNEO2.XAC570.
PAGE 83
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server You can also specify an alternative ACACL file to process as in the following example: Example: $SYSTEM.XGYATEAC 34> RUN DBSO DSTATS NEWACL XYGATEAC 5.75 XYPRO \N1 20991231 (see <
PAGE 84
XYGATE® Access Control Reference Manual Chapter 4. DBSO – The Database Server The XAC macro XAC_COMMANDS displays the same information as in the following example: Example: 16> XAC_COMMANDS XYGATEP.TEST1 Checking commands for user XYGATEP.
PAGE 85
Chapter 5. Command/User Access Matrix For many audit investigations, it is important to be able to show which users have access to which COMMANDS. Use the XAC_ACCESS_MAP macro to generate this information. (Refer to Appendix E7: on page 251.) 5.1 Procedure The following is the syntax for the XAC_ACCESS_MAP macro. Syntax: XAC_ACCESS_MAP [ ! ] Where: is the entry sequenced, csv file that contains the information. If the file does not exist, it will be created.
PAGE 86
XYGATE® Access Control Reference Manual Chapter 5. Command/User Access Matrix Sample output file: TACL-STATIC-IP ,$SYSTEM.SYSNN.TACL,GROUP,USER,"Keystroke audited TACL",user,255,255,SUPER.SUPER UPDATE-XAC-ACL ,$SYSTEM.SYSNN.TACL,222,233,"Updates the ACACL file",alias,222,233,ROBIN UPDATE-XAC-ACL ,$SYSTEM.SYSNN.TACL,222,233,"Updates the ACACL file",alias,222,233,Robin UPDATE-XAC-ACL ,$SYSTEM.SYSNN.TACL,222,233,"Updates the ACACL file",alias,222,233,SEC.LAURENTO9 UPDATE-XAC-ACL ,$SYSTEM.SYSNN.
PAGE 87
Chapter 6. EMS Message Format Templates A template is supplied on the installation subvolume to allow the audit lines written to EMS to be tokenized and organized as desired by the customer. Three files are supplied at installation to allow this customization. The three files are: 6.1 EMSBUILD A macro to build the template file based on the system templates and the EMSTEMP file. EMSDDL A DDL layout for the EMS message. EMSTEMP The TEMPLATE layout for the XYGATEAC messages.
PAGE 88
XYGATE® Access Control Reference Manual Chapter 6. EMS Message Format Templates Do you want the installation performed ? Y Building Dictionary with the following input file, please wait ?dictn $SYSTEM.XYGATEEM ! ?source $SYSTEM.ZSPIDEF.zspiddl ?source $SYSTEM.ZSPIDEF.zemsddl ?source $SYSTEM.XYGATEAC.EMSDDL Constant XAC-EVENT-COMMAND PAGE 176 $SYSTEM.XYGATEAC.EMSDDL [4] (16DEC94) SYSTEM \XYPRO DATE - TIME : 5/27/97 DICTIONARY SUBVOL: $SYSTEM.
PAGE 89
XYGATE® Access Control Reference Manual Chapter 6. EMS Message Format Templates 1:ssid ( zems-val-ssid,zems-tkn-text) DSM TEMPLATE COMPILER - T9633D30 - (31OCT94) COPYRIGHT TANDEM COMPUTERS INCORPORATED 1989-1994 End of compilation Object file: $SYSTEM.XYGATEEM.EMSTEMPO Format templates: Override templates: Special templates: 4 0 2 Errors: Warnings: 0 0 Running TEMPLI with following input file: FILE $SYSTEM.SYS04.TEMPLATE FILE $SYSTEM.XYGATEEM.EMSTEMPO TANDEM.
PAGE 90
XYGATE® Access Control Reference Manual Chapter 6.
PAGE 91
Chapter 7. XAC Auditing and Audit Reports Up to nine audit locations can be defined for XAC. The audit information can be written to diskfiles, processes and IP addresses. The XAC software includes two macros (XAC_AUDIT_REPORT and XAC_REPORT) that will generate reports from audit information that is written to an ENSCRIBE file. 7.1 AUDIT File Considerations This section explains Audit file creation and rollover behavior in XAC. 7.1.
PAGE 92
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports message will be written to the EMS log from each running XYGATEAC process that encounters the error. The audit file check will also be tried after a timeout occurs, if a timeout is defined, or after 5 minutes.
PAGE 93
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports fi XYGAUDIT.ACL* $VIK.XYGAUDIT CODE EOF LAST MODIFIED OWNER RWEP PExt Sext ACL00015 3333 266240 30JUL2013 16:48 232,52 NNNC 300 300 ACL00016 3333 266240 25AUG2013 16:23 232,52 NNNC 300 300 $SYSTEM XYGATEAC 6> VOLUME $VIK.XYGATEAC $VIK XYGATEAC 7> RUN XAC INSTALL $VIK XYGATEAC 8> #OUTPUT [XAC_NEXTGEN XYGAUDIT.ACL] XYGAUDIT.
PAGE 94
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports The default ENFORM temporary work file location is the <$vol.subvol> from which ENFORM is executed. This volume portion of the ENFORM temporary work file location can be changed via assigns, but the subvol portion cannot be changed. Therefore, the users must have Create and Write access to these files in the <$vol.subvol> from which the report macro is executed.
PAGE 95
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports yyyy-mm-dd hh:mm XAC-O [ggg,uuu] Examples: 2001-04-02 11:08:53.362360XAC-C 00134A6C0AFD \XYS7000 [222,233] $ZTNP2.#PT7N8Y1 FUP-255 XYPRO.LAUREN 000001license $system.xygateac.xygateac 2001-04-02 11:32:06.141432XAC-O 00134A6DEDFE \XYS7000 [222,233] $ZTNP2.#PT7N8Y3 CALC-TEST-AUDITOUTPUT XYPRO.
PAGE 96
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports This field contains the group number of the user ID of the user executing the command. When the user ID is an alias, this number is the group number of the underlying userid. 03 GROUP-NUMBER PIC 9(3). This field contains the user number of the user ID of the user executing the command. When the user ID is an alias, this number is the group number of the underlying user. 03 USER-NUMBER PIC 9(3).
PAGE 97
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports This field contains the group number of the userid that was named in TARGETLOGIN-NAME. If TARGET-LOGIN-NAME is a Safeguard alias, then this field contains the group number of the userid that underlies the alias. 03 TARGET-GROUP-NUMBER PIC 9(3). This field contains the user number of the userid that was named in TARGET-LOGINNAME.
PAGE 98
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports o Command failed because the user attempted to open a file prohibited by OPENSBYOBJECTS. p Command failed because an incorrect password was entered at the PASSWORDTIMEOUT prompt. r Command failed because the RUNCHECK keyword prohibited the use of the RUN xxx /IN .../ syntax. s Command failed because there is a syntax error in the ACACL Command Entry. t Command failed because the PORT check failed.
PAGE 99
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports This field contains the command that was entered by the user. 03 USER-COMMAND 7.5 PIC X(500). XAC Report Formats There are four ways to display detailed information from the XAC audit files. Another report called COUNTS allows you to display information about which XAC Command Entries are being used and how often.
PAGE 100
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports SESSION When the SESSION format is chosen, the information is sorted by session number. Each session is shown in order by the time of the first record of the session. Each set of XAC-C and, if output is displayed, XAC-O records is displayed together, regardless of userid.
PAGE 101
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports LOGINNAME When the LOGINNAME format is chosen, the information is sorted by the LOGIN NAME of the user. LOGIN NAME can be a standard NSK userid or it can be an alias. Sample Audit Report Sorted by Loginname : XYPRO Technology Corporation \N1 Date produced: 29-APR-2010 XAC Activity by Login NameCLASS.USER8 Page: 1 Criteria: 2010-04-29 00:00 to 2010-04-29 23:59 File:\N1.$SYSTEM.XYGATEAC.
PAGE 102
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports TIME When the TIME format is chosen, the information is sorted by the TIME at which the audit record was written. Sample Audit Report Sorted by TIME : XYPRO Technology Corporation \N1 Date produced: 29-APR-2010 XAC Activity by Time Page: 1 Criteria: 2010-04-29 00:00 to 2010-04-29 23:59 File:\N1.$SYSTEM.XYGATEAC.
PAGE 103
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports COUNTS The COUNTS report summarizes the number of times each entry in the ACACL file is used. Sample Audit Report Sorted by COUNTS : XYPRO Technology Corporation \N1 XAC Date produced: 29-APR-2010 Criteria: 2010-04-10 00:00 to 2010-04-29 23:59 File:\N1.$SYSTEM.XYGATEAC.
PAGE 104
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports 7.6 Interactive XAC_REPORTs Ad-hoc reports can be obtained from the audit files by using the XAC-supplied report macro. The report macro is named based on the name selected for invoking XYGATEAC ACACL Command Entries. For example, if XAC was selected as the TACL Macro to invoke XYGATEAC commands, the invocation for the ad-hoc report macro would be XAC_REPORT.
PAGE 105
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports If you press ZP, the XAC_REPORT macro will generate the report and put you into PERUSE. When you have examined, printed or written the report to an edit file, and type EXIT, you will be returned to the Report Selection screen where you may resume report selection. To CLOSE the Report Selection screen, select X to return to your TACL prompt. A: Audit File Enter the name of the audit file you want to use to generate the report.
PAGE 106
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports To choose a date range, select B. Example: Selection? B If the leading portion of a date is omitted it will default to today's date, I.E.
PAGE 107
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports E: Subject Terminal You may limit your report to processing done from a selected terminal or group of terminals. You may enter a valid terminal name or an asterisk ( * ) to include all terminals. If you enter a portion of a terminal name, all terminals containing the entry will be included in the report. For example, if you enter ZTNP, any TCP/IP terminals identified by those letters will be included in the report.
PAGE 108
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports H: Violations Only You may choose to have only audit records where the COMMAND-STATUS field is not blank displayed. A non-blank status means that an error of some sort occurred. Example: Selection? H Do you want to only see Violations ? YES Only records with an error will be printed. I: Output File The XAC_REPORT macro puts a job in the spooler called $S.#XYGATE.ACCESS. To change the spooler location, select I.
PAGE 109
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports K: User Specified Title You can assign a custom title to your report. To enter the title, select K and enter the desired information.
PAGE 110
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports If you put an asterisk ( * ) at the end of the string, XAC will include any IP address that begin with the entry will be included in the report. Example IP Address: 123* finds all IPAddresses starting with 123. 205* finds all IPAddresses starting with 250. If you enter an IP addresses without either a leading or trailing asterisk, then XAC will only include the IP addresses that exactly match the IP address you have entered.
PAGE 111
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports ZP: Run the Report and Go Directly into Peruse When you select ZP to create the report, the XAC_REPORT macro will generate the report and put you directly into PERUSE. When you have examined, printed, or written the report to an edit file, and typed EXIT, you will be returned to the XAC Report Selection screen where you may change your selections and create another report.
PAGE 112
XYGATE® Access Control Reference Manual Chapter 7. XAC Auditing and Audit Reports 7.7 Batch XAC_AUDIT_REPORTs The XAC_AUDIT_REPORT macro is used to generate the same report in a batch manner as XAC_REPORT does interactively. With the addition of the XAC_DATETIME_MAKE macro, a batch report can be written to provide periodic reports.
PAGE 113
Chapter 8. OSS Auditing XAC can audit OSS activity. 8.1 Configuring ACACL Command Entries for OSS The keyword AUTHENTICATE_USER is required to force the login prompt to be displayed. XAC processes the login and then starts the OSS shell. Example: COMMAND OSS-AUDITED-SHELL !The command starts an OSS shell for a regular user. The user !must enter the user's own OSS space userid. !XYGATE/OA is used to mediate OSS access.
PAGE 114
XYGATE® Access Control Reference Manual Chapter 8. OSS Auditing 8.2 Starting Audited OSS Sessions Once the ACACL Command Entry has been defined, it can be added to the TELNET services list so the user can enter it at the TELNET service prompt. A sample TELNET definition is the following: Example: 4> xac scf-255 XYGATEAC 5.75 XYPRO \N1 20991231 (see <
PAGE 115
XYGATE® Access Control Reference Manual Chapter 8. OSS Auditing When XYGATEOA, which is the OBJECT program of the OSS-AUDITED-SHELL (shown in the Example of section 8.1 above) is started, XYGATEAC will start auditing the activities on the XYGATEOA session. Welcome to the XYPRO Technology Corporation Computing Facility \N1. Last Logon: 25 AUG 2013, 07:42 Last Unsuccessful Attempt: 25 AUG 2013, 06:42 Total Failures: 115 XYGATEAC 5.
PAGE 116
XYGATE® Access Control Reference Manual Chapter 8. OSS Auditing K: L: M: N: X: Z: ZP: User specified title :* User Input :* IP Address :* Display all characters:No Exit the report macro Run the audit report Run the audit report and go into PERUSE and return here Hit Break or Control-Y to terminate Selection?b If the leading portion of a date is omitted it will default to today's date, I.E.
PAGE 117
XYGATE® Access Control Reference Manual Chapter 8. OSS Auditing Criteria: 2013-08-25 07:41 to 2013-08-25 23:59 File:$VIK.XAC575.AUDIT MM-DD-YYYY HH:MM Login name SeqNum ---------- ----- -------------------------------- ------ XAC Command=OSS-AUDITED-SHELL Session=001C66323DF8 System= 08-25-2013 07:42 QA.IK 1 Cmd: LOGON qa.ik 08-25-2013 07:42 QA.IK 2 Cmd: Good password at authenticate prompt 08-25-2013 07:42 QA.IK 3 Cmd: -xac 08-25-2013 07:42 QA.IK 4 Out: /G/VIK/IK: 08-25-2013 07:42 QA.
PAGE 118
XYGATE® Access Control Reference Manual Chapter 8. OSS Auditing MM-DD-YYYY HH:MM Login name SeqNum ---------- ----- -------------------------------- -----08-25-2013 07:42 QA.IK Out: Sun Aug 25 07:42:42 PDT 2013 08-25-2013 07:42 QA.IK Out: /G/VIK/IK: 08-25-2013 07:43 QA.IK Cmd: 08-25-2013 07:43 QA.IK Out: /G/VIK/IK: 08-25-2013 07:43 QA.IK Cmd: 08-25-2013 07:43 QA.
PAGE 119
Appendix A: The ACCONF File The ACCONF file is an edit file that configures global values and is kept in the same volume and subvolume as the XYGATEAC object file. The ACCONF file contains the keywords that define the external functionality of the XAC process. Important! Many of the keywords in the ACCONF file set the general condition of the software execution and can be overridden at the ACACL level for individual groups of userids.
PAGE 120
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File MONITOR_DEFINE_ALLOWED { ON | OFF } OBEYFILES $.
PAGE 121
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A2: Sample ACCONF File The ACCONF file configures global values. The following is a sample ACCONF file. !Audit File Definitions AUDIT $0 EMS CONSOLEPRINT AUDIT \MASTER.$LOGS.NODE1.ACCRITCL CRITICAL AUDIT $WORK.XYLOGS.XACAUDIT AUDIT $ZTC0 IP 208.999.151.70:514 DETAIL INVOKE AUDIT $ZTC0 IP 10.1.1.
PAGE 122
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A3: AUDIT (Filename) This keyword determines the audit file specifications when a filename is defined. Refer to Chapter 7, “XAC Auditing and Audit Reports” for more information. Syntax: AUDIT [DETAIL] [INVOKE] [CRITICAL] [EXT(pri,sec,max)] [NO_ROLL_MSGS] DETAIL The optional DETAIL sub-keyword includes audit of specific tasks or commands that were performed by the user in this session.
PAGE 123
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File Example 4: EMS error 45 message on $VIK.XYLOGS.XAC, but no Error 45 on $VIK.XYLOG.XAC 13-08-25 17:13:10 \N1.0,840 13-08-25 17:13:10 \N1.0,840 13-08-25 17:13:10 \N1.0,840 13-08-25 17:13:10 \N1.0,840 13-08-25 17:13:10 \N1.0,840 XYPRO Technology Corporation TANDEM.EMS.H01 000512 XYGATEAC Error 0045 on audit file $VIK.XYLOGS.XAC, retrying TANDEM.EMS.H01 000512 XYGATEAC Audit file renamed from $VIK.XYLOGS.XAC to $VIK.XYLOGS.XAC00003 TANDEM.
PAGE 124
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A4: AUDIT (Process Name) Any one of the nine available AUDIT keyword entries can be defined as a process audit trail. The most common process audits are EMS and printing to the CONSOLE. Refer to Chapter 7, “XAC Auditing and Audit Reports” for more information.
PAGE 125
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File Example 3: Print XAC Audit log through EMS distributor $VIK IK 13> EMSDIST TYPE p, COLLECTOR $IKXAC, TEXTOUT [#MYTERM] 13-08-25 18:06:27 \N1.$Y0MV XYPRO.6.B00 000002 2013-08-25 18:06:27.754816XAC-I 001C666B65F2 [232,052] $VIK.IK $IKTEL.#PTT7BDE FUP-255 \N1.$X99N:514445249 \N1.$Y0MV:522246849 \N1.$Y0M W:522247105 QA.IK SUPER.SUPER 255255 13-08-25 18:06:27 \N1.$Y0MV XYPRO.6.B00 000003 2013-08-25 18:06:27.
PAGE 126
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A5: AUDIT (IP Process Name) Any one of the nine available AUDIT keyword entries can be defined as an IP address. This section deals with the IP address form of the AUDIT specification. Refer to Chapter 7, “XAC Auditing and Audit Reports” for more information.
PAGE 127
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File < AUDIT message > <134>NonStop \N1 2013-09-04 17:30:50.106469XAC-I 001C6B8E7EE5 $VIK.XAC575 $IKTEL.#PTT7BF0 FUP-255 \N1.$Z8TQ:617356225 \N1.$X26K:627766721 \N1.$X26L:627766977 QA.IK 255255 [232,052] SUPER.SUPER SYSLOG_CRITICAL_PREFIX The optional SYSLOG_CRITICAL_PREFIX sub-keyword is used to specify text that will be prepended at the front of any denied audit message being written to the IP address.
PAGE 128
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A6: BLOCKMODE_AUDIT This keyword determines whether the individual function keys pressed by the XYGATEAC session user will be audited. If BLOCKMODE_AUDIT is set to ON, the individual function keys will be audited. If it is set to OFF, they will not. Hidden fields will not be audited so that user names and passwords will not appear in XAC’s audit trail.
PAGE 129
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A8: COLLECTOR This keyword sets the name of the default spooler collector to use for report generation using the XAC_REPORT macro. Syntax: COLLECTOR Example: COLLECTOR $S2 If this keyword is omitted from the ACCONF file, the $S collector will be used as the default. A9: COMMANDESCAPE This keyword sets the command escape lead-in character(s).
PAGE 130
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A11: DEVICEINFO_LINE_REPLY This keyword controls the value that is returned when a DEVICEINFO call is made against the XAC process. This is similar to the DEVICEINFO_REPLY keyword in the ACACL that deals with DEVICEINFO calls made to the XAC .#IN subdevice.
PAGE 131
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A13: EMS_CRITICAL_IF_DENIED This keyword causes XAC to set the critical flag on an EMS audit message that reports an attempt by a user to execute an unauthorized ACACL Command Entry. This keyword only applies when at least one of the AUDIT entries points to EMS. Having the critical flag set can affect the behavior of some EMS management products.
PAGE 132
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A15: HOMETERM This keyword causes the database server (DBSO) to set its hometerm to the specified . Syntax: HOMETERM Example: HOMETERM $MYOPS.#CLI A16: IPMAP In order for XAC to be able to capture the IP address in a session encrypted via XHE, XAC must query the IPMAP file in XYGATEHE’s subvolume. The IPMAP keyword specifies the XYGATEHE subvolume. The IPMAP file is maintained by XYGATEHE. Syntax: IPMAP <$vol.
PAGE 133
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A18: MONITOR This keyword defines the output file for the detailed internal trace information generated by a XYGATEAC process that is executing an ACACL Command Entry which has the MONITOR keyword set. The parameters are defined as: Syntax: MONITOR { HOMETERMINAL | } The HOMETERMINAL parameter causes the monitor information to be written to the current terminal. The parameter is an existing HP NonStop filename.
PAGE 134
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A20: OBEYFILES This keyword sets the default volume and subvolume to be used in expanding filenames referenced by the FILE or OBEY keywords in an ACACL Command Entry. Syntax: OBEYFILES $. Example: OBEYFILES $SYSTEM.
PAGE 135
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A21: OBEY_PROMPT This keyword suppresses the prefixing of an obey file input line(s) with the current prompt when the input files are displayed. Syntax: OBEY_PROMPT {ON | OFF} Example 1: OBEY_PROMPT ON Input lines display: $SYSTEM.XYGATEAC 1> OBEY obeytst $SYSTEM.XYGATEAC 1> fileinfo acacl $SYSTEM.XYGATEAC CODE EOF LAST MODIFIED OWNER RWEP ACACL 101 39374 01JUL2004 7:54 222,212 CCCC PExt 16 SExt 16 $SYSTEM.
PAGE 136
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A22: PASSONTIMEOUT This keyword controls whether the creator process is informed when a XYGATEAC process times out. If PASSONTIMEOUT is ON and XAC was invoked from a TACL via the XAC macro and the XYGATEAC process times out, then the invoking TACL will be logged off. Execution of the XYGATEAC object file without the XAC macro will receive a timeout message from XYGATEAC and may process the timeout information differently.
PAGE 137
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A25: PRIORITY This keyword sets the priority at which each XYGATEAC process runs. If the XYGATEAC process starts the DBSO object file (Database Server process), then the priority of the Database Server process is one greater than this value. Syntax: PRIORITY Example: PRI 150 The priority of individual processes is set using the ACACL keyword PRI.
PAGE 138
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A28: SHUTDOWN_MESSAGES This keyword determines whether the extra messages that XYGATEAC receives after the OBJECT program and its subordinates have terminated are displayed.
PAGE 139
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A31: TIMEOUT This entry configures the XYGATEAC process to use this value as a user input TIMEOUT (in seconds) for any programs run under its control. When the timeout occurs in conversational mode, an error 1 (end-of-file) is returned to the application. When the timeout occurs in block mode, an error 60 (device is down) is returned to the application.
PAGE 140
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File A33: USER_SWITCH By default, when a process creates another process, the created process inherits the PAID and LOGONNAME of the creator. On the other hand, XYGATEAC uses the userid specified next to the USER keyword when XYGATEAC creates a process, but it may not use the userid as LOGONNAME. This depends on the USER_SWITCH values. The USER_SWITCH keyword modifies the manner in which XYGATEAC changes userids.
PAGE 141
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File • If you need the USER in an XAC command to be an alias, you must use SWITCH, LOGON, or SAFEGUARD_PRIVLOGON. If you choose SWITCH and enter an alias as the USER, then the command will actually run as the alias’ underlying userid. • If your site uses Safeguard FILE-SHARING GROUPS, you must use LOGON, PRIVLOGON or SAFEGUARD_PRIVLOGON.
PAGE 142
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File Example 1: XAC Command Entry where USER argument is an alias COMMAND test USER ALIAS:”super-super-alias” ! underlying userid is 255,255 ACL $EVERYONE OBJECT $SYSTEM.SYSNN.
PAGE 143
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File 2. LOGON When USER_SWITCH is set to LOGON, file sharing groups are completely supported. PASSWORD-REQUIRED must be set to OFF in Safeguard. The USER keyword in the ACACL entry can be set to a userid or a Safeguard alias. If it is set to an alias, the COMMAND will actually run as the alias.
PAGE 144
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File 3. PRIVLOGON When USER_SWITCH is set to PRIVLOGON, file sharing groups are supported for Guardian userids, but not Safeguard aliases. PASSWORD-REQUIRED does not have to be set to OFF. The USER keyword in the ACACL COMMAND can be set to a userid but not to a Safeguard alias.
PAGE 145
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File Example 1: XAC Command Entry - USER argument is an alias COMMAND test USER ALIAS: "ROLE" ! underlying userid is 223,24 ACL $EVERYONE OBJECT $SYSTEM.SYSNN.
PAGE 146
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File In order to use the SAFEGUARD_PRIVLOGON option, create a Safeguard DISKFILE Protection Record for the XYGATEAC object file and set attribute PRIV-LOGON to ON as shown below. Example 5: The DISKFILE Protection Record for the XAC Object File LAST-MODIFIED OWNER STATUS WARNING-MODE $SYSTEM.XYGATEAC XYGATEAC 10AUG08, 1:01 \*.253,1 THAWED OFF \*.253,1 \*.
PAGE 147
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File AUDIT_ACCESS_PASS AUDIT_ACCESS_FAIL OFF ON The default value of USER_SWITCH is SWITCH, which does not change the previous functionality of XYGATEAC. The value of this keyword can be overridden by the USER_SWITCH keyword in the ACACL Command entry. This keyword can be used in the ACCONF or in individual COMMANDs in the ACACL file. The value set in the ACACL Command entry will always override the value set in the ACCONF file.
PAGE 148
XYGATE® Access Control Reference Manual Appendix A: The ACCONF File XYPRO Technology Corporation 120 Proprietary and Confidential
PAGE 149
Appendix B: The ACCONFCO File The ACCONFCO (XYGATEAC Company Configuration) is an optional edit file and is kept in the same volume and subvolume as the XYGATEAC object file. The ACCONFCO file contains the configuration options that determine what userid limitations will be enforced on the USER keyword in the ACACL file. The ACCONFCO file can be used to allow the delegation of XAC maintenance to subordinate security administrators.
PAGE 150
XYGATE® Access Control Reference Manual Appendix B: The ACCONFCO File B4: AUDIT (IP Address Form) This keyword determines the audit file specifications when a IP address is defined. Refer to Appendix A5: “AUDIT (IP Process Name).” B5: USER_ACL The USER_ACL list is specified as a set of userids or aliases that are valid arguments for the USER keyword in all of the entries in the ACACL file. Syntax: USER_ACL Example: USER_ACL *.* NOT SUPER.
PAGE 151
Appendix C: The ACACL File The ACACL file is an edit file located in the same volume and subvolume as the XYGATEAC object file. The ACACL file contains ACLGROUP definitions (refer to section 2.7.3, “ACLGROUPs” on page 40) and ACACL Command Entries (starting on page 138). These two types of entries contain all the information necessary for XAC to execute commands for a NonStop Kernel user.
PAGE 152
XYGATE® Access Control Reference Manual Appendix C: The ACACL File NULLNULLSTOP !When the logoff happens, stop. !Ensure that anyone using this command re-enters the user's !password for userid validation. VERIFYUSER $EVERYONE !Replace the word that follows a PASSWORD command or subcommand !with 8 pound signs in the audit. BLANKPASSWORD !If V or VOLUME is used to change volume, change XYGATE/AC's obey !file default too. TRACKVOLUME FC !Use simple FC !FC is valid at commands that end with this prompt.
PAGE 153
XYGATE® Access Control Reference Manual Appendix C: The ACACL File ACL $SUPER START_LOGGED_ON !Ensure the segment of macros is there INPUT "RUN $VIK.XAC575.X575 INSTALL" !Start macro to record information INPUT "XAC_RUN_MACRO -PLAIN -BREAK $VIK.XAC575.PRMPTMAC" ALIAS_ALL_PROCESSES ALIAS "O " ">OBEY " ALIAS "OBEY " ">OBEY " ALIAS "O$" ">OBEY $" ALIAS "O\" ">OBEY \" NULLNULLSTOP VERIFYUSER $EVERYONE BLANKPASSWORD TRACKVOLUME FC FCPROMPT "> " OPENSBYOBJECTS \*.$*.*.
PAGE 154
XYGATE® Access Control Reference Manual Appendix C: The ACACL File FC FCPROMPT "> " OPENSBYOBJECTS \*.$*.*.* TIMEOUT 1800 !Use simple FC !FC is valid at a prompt ending in this !Allow all subordinate programs !Terminate after 30 minutes of inactivity COMMAND TACL-ASYNCH !This command is used to put a keystroke audited TACL on an asynchronous !terminal. It should be started as part of the system startup. No !other TACL should be started for a terminal that is using this one.
PAGE 155
XYGATE® Access Control Reference Manual Appendix C: The ACACL File COMMAND TACL-STATIC-IP ! !This command is designed to be used as the standard startup for TACLs !attached to a static IP port. ! DESCRIPTION "Keystroke audited TACL" USER 255,255 ACL $EVERYONE OBJECT $SYSTEM.SYSNN.
PAGE 156
XYGATE® Access Control Reference Manual Appendix C: The ACACL File COMMAND EDIT-255 !This command starts EDIT as the SUPER.SUPER userid. DESCRIPTION "Edit as SUPER.SUPER" USER 255,255 OBJECT $SYSTEM.SYSTEM.EDIT ACL $SUPER FC? FCPROMPT "*" TIMEOUT 900 OPENSBYOBJECTS $SYSTEM.SYSTEM.VS $SYSTEM.SYSTEM.TEDIT COMMAND FUP-255 ! This command is used to execute FUP as SUPER.SUPER DESCRIPTION "FUP as SUPER.SUPER" USER 255,255 OBJECT $SYSTEM.SYSNN.
PAGE 157
XYGATE® Access Control Reference Manual Appendix C: The ACACL File !*** NOTE **** This disables SQLCI's internal FC !All commands will be audited BUT only ONE-LINE commands are permitted. !Comment-out FC and FCPROMPT to return to SQLCI's internal FC. FC? FCPROMPT ">>" COMMAND MEDIACOM-255 !This command is designed to let privileged users have access to !an audited MEDIACOM running as SUPER.SUPER DESCRIPTION "MEDIACOM as SUPER.SUPER" USER 255,255 OBJECT $SYSTEM.SYSNN.
PAGE 158
XYGATE® Access Control Reference Manual Appendix C: The ACACL File COMMAND XMA-PWSTOP !This command is designed to set up a macro for users that !administer XYGATE/MA. DESCRIPTION "Stops the XMA pathway" USER 232,52 !This should be XYGATE/MA owner OBJECT $SYSTEM.SYSNN.TACL ACL $SECURITY SUPPRESSUNTILPROMPT NOCOPYRIGHT QUIET START_LOGGED_ON INPUT "#SET #BREAKMODE DISABLE" !Disable break key !Fix the line below to point to your XYGATE/MA installation subvol INPUT "RUN $SYSTEM.XYGATEMA.
PAGE 159
XYGATE® Access Control Reference Manual Appendix C: The ACACL File INPUT "XYGATEAC_RUN_MACRO -EXIT -PLAIN -BREAK XMA_PWCOLD" !If macro times out, do not send timeout to starting process PASSONTIMEOUT OFF OPENSBYOBJECTS \*.$*.*.* !Allow all subordinate to be started VERIFYUSER $EVERYONE TRACKVOLUME PASSWORDTIMEOUT 60 COMMAND OSS-AUDITED-SHELL !The command starts an OSS shell for a regular user. The user !must enter the user's own OSS space userid. !XYGATE/OA is used to mediate OSS access.
PAGE 160
XYGATE® Access Control Reference Manual Appendix C: The ACACL File COMMAND CMDINFO ! Security can list all cmds for a given user." DESCRIPTION "Usage: X575 cmdinfo " OBJECT $VIK.XAC575.DBSO USER SUPER.SUPER ! fill in appropriate SEC.ADMIN ID here ACL $SECURITY STARTUP "commands %*" PERCENT ON PASSONTIMEOUT OFF NOAUDIT COMMAND MYCMDS ! Users can an list all cmds for a given user." DESCRIPTION "Each user's XAC COMMANDS" OBJECT $VIK.XAC575.DBSO USER GROUP.
PAGE 161
XYGATE® Access Control Reference Manual Appendix C: The ACACL File PERCENT ON INPUT "#SET #BREAKMODE DISABLE" !Fix the line below to point to your XYGATEOS installation subvol INPUT "RUN $SYSTEM.XYGATEOS.XOS INSTALL" INPUT "RUN $VIK.XAC575.X575 INSTALL" INPUT "XYGATEAC_RUN_MACRO -exit -plain -break XOS_OSSSEEP_ADD_MULTI %*" PASSONTIMEOUT OFF OPENSBYOBJECTS \*.$*.*.
PAGE 162
XYGATE® Access Control Reference Manual Appendix C: The ACACL File SUPPRESSUNTILPROMPT NOCOPYRIGHT QUIET START_LOGGED_ON PERCENT ON INPUT "#SET #BREAKMODE DISABLE" !Fix the line below to point to your XYGATEOS installation subvol INPUT "RUN $SYSTEM.XYGATEOS.XOS INSTALL" INPUT "RUN $VIK.XAC575.X575 INSTALL" INPUT "XYGATEAC_RUN_MACRO -exit -plain -break XOS_FILESET_ENABLE %1" PASSONTIMEOUT OFF OPENSBYOBJECTS \*.$*.*.
PAGE 163
XYGATE® Access Control Reference Manual Appendix C: The ACACL File COMMAND STATUS-OSS-SEEP !Does Status on XOS's OSS Environment DESCRIPTION "Usage: X575 STATUS-OSS-SEEP" USER 255,1 !Must be in SUPER gp but cannot be SUPER.SUPER OBJECT $SYSTEM.SYSNN.TACL ACL $SECURITY SUPPRESSUNTILPROMPT NOCOPYRIGHT QUIET START_LOGGED_ON INPUT "#SET #BREAKMODE DISABLE" !Fix the line below to point to your XYGATEOS installation subvol INPUT "RUN $SYSTEM.XYGATEOS.XOS INSTALL" INPUT "RUN $VIK.XAC575.
PAGE 164
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C2: ACACL Command File Limits The ACACL Command File is loaded into the memory of DBSO. Limits on the individual keywords and overall command limits depend on the size of the message between XYGATEAC and DBSO. Single Command Limits The total size of the message sent from DBSO to XYGATEAC to define an ACACL entry can be a maximum of 16384 characters.
PAGE 165
XYGATE® Access Control Reference Manual Appendix C: The ACACL File Limits on ACACL File Command Entries Various keywords have limits on the number of times they can occur in an ACACL file. The following list shows the keywords for which there are limits and the current limit. Keyword Limit COMMAND 2,000 Command Entries in an ACACL file. ACLGROUP 200 ACL / VERIFYUSER / AUDITUSER Userid specification is limited to 32,767 users, with a completely specified userid (PROD.
PAGE 166
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C3: ACACL Command Entries The COMMAND keyword defines the name of an XAC ACACL Command Entry and must be the first line of the entry. Three more keywords are required to minimally define an ACACL Command Entry: USER, OBJECT and ACL (starting on page 141). The DESCRIPTION keyword is optional but highly recommended.
PAGE 167
XYGATE® Access Control Reference Manual Appendix C: The ACACL File One or more of the optional keywords listed in Appendix C4: starting on page 146. A list of valid userids that will be able to execute the ACACL Command Entry. Note that for security reasons XYGATEAC will declare this ACACL command invalid with a syntax error if any non-valid userid is used or if a userid is deleted which is part of an ACL keyword of an ACACL Command Entry.
PAGE 168
XYGATE® Access Control Reference Manual Appendix C: The ACACL File The above COMMAND will execute TACL as the user who invokes the COMMAND. When this TACL is started, it runs the SETVIIP macro which sets a variable with the TCP/IP address that is needed for Visual Inspect. If you prefer, users who will run Visual Inspect can also run the SETVIIP macro within their TACLCSTM files by adding the following line: Run $..SETVIIP Where $. represents the XYGATEAC location on your system.
PAGE 169
XYGATE® Access Control Reference Manual Appendix C: The ACACL File The ACACL Command Entry for TACLs started by MLRM can be: COMMAND SYSTEM-SYSNN-MLRM DESCRIPTION "TACL for Multilan" USER GROUP,USER OBJECT $SYSTEM.SYSNN.TACL ACL \*.*.* NOT PROD.APPL START_LOGGED_OFF TRACKUSERID EXECUTEHANGUP NULLNULLNOCMDESC BLANKPASSWORD AUDITUSER \*.*.* TIMEOUT 900 OPENSBYOBJECTS \*.$*.*.* STOPONERROR 140,190,191 DONOTSTOP $SYSTEM.SYSTEM.
PAGE 170
XYGATE® Access Control Reference Manual Appendix C: The ACACL File Note: Due to current operating system restrictions, if user is specified as ALIAS:"", the actual PAID of the process will be the underlying userid to which the alias was assigned when it was created in Safeguard. In the Example below, this XAC ACACL Command Entry runs as SUPER.OPERATOR. Only users in group 10 can execute this command. Example: COMMAND TCPIPUP DESCRIPTION "Uses SCF to INITIATE TCPIP processes" USER SUPER.
PAGE 171
XYGATE® Access Control Reference Manual Appendix C: The ACACL File The Example below starts a TACL with a PAID equal to the userid that the Safeguard Alias MailMgr is assigned to. It can be used by any user logged on using a Safeguard Alias that begins with Oper. Example: COMMAND MAIL-UP USER ALIAS:"MailMgr" OBJECT $SYSTEM.SYSNN.TACL ACL ALIAS:"Oper*" OBJECT OBJECT specifies the name of a HP NonStop object file to be executed.
PAGE 172
XYGATE® Access Control Reference Manual Appendix C: The ACACL File ACL The ACL keyword specifies the list of users who can execute this ACACL Command entry. Each userid in a list is specified as follows: . -or, -or<\Node>., -or<\Node>., -orALIAS:"" -orALIAS:"<\Node>." -orUNDERLYING:, -orUNDERLYING:, -orNETUNDERLYING:<\Node.>.
PAGE 173
XYGATE® Access Control Reference Manual Appendix C: The ACACL File Node names in the ACL keyword can be specified with wildcarding components. The wildcard characters are: ? match letter or number * match rest of string @ match any ALPHA character + match any NUMERIC character Example: COMMAND CHECK-SPOOL USER 255,255 OBJECT $SYSTEM.SYSNN.TACL ACL \N1*.255,* ALIAS:"\N1*.Super-*" FILE $SYSTEM.OBEY.
PAGE 174
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C4: Optional ACACL Command Entry Keywords The following are optional ACACL Command Entry keywords for XAC: ALIAS "" "" ALIAS_ALL_PROCESSES ALIAS_OSS_PROCESSES ALIAS_XYGATEAC_PROCESSES { ON | OFF } ALLOWCMD "" ALLOW_CHECK_ALIASES ALLOWDENY_ALL_PROCESSES AUDIT_OUTPUT_COUNT AUDITPROG AUDITUSER AUTHENTICATE_USER { ON | OFF } BANNER_CONNECT BANNER_FIRSTIO
PAGE 175
XYGATE® Access Control Reference Manual Appendix C: The ACACL File FC# FC? FCPROMPT "" FILE FILE_SECURITY { PAID | CAID | XXXX } HIGHPIN IGNOREBREAKUNTILPROMPT IGNORECONNECT INPUT "" JOBID LOWPIN MAP_B_FKEY MAP_C_FKEY MAP_FKEY_ALL_PROCESSES MONITOR MONITORAUDIT MULTIPLECOMMANDSEP NOASSIGNS NOAUDIT NOBREAK NOCOMMANDAUDIT NOCOMMANDESCAPE NOCOPYRIGHT NULLNULLNOCMDESC NULLNULLSTOP OBEY OBORUNCHECK OPENSBYOBJ
PAGE 176
XYGATE® Access Control Reference Manual Appendix C: The ACACL File PASSTHRU_ABEND { ON | OFF } PASSWORDTIMEOUT PERCENT { ON | OFF } PORT PRI PROMPT "[,,...]" QUIET RESTART REXP_ALLOWDENY RUN_UNTIL_CLOSED RUNCHECK SHUTDOWN_MESSAGES { ON | OFF } SISO STARTUP "" START_LOGGED_OFF START_LOGGED_ON STOPIFAUDITERROR STOPONERROR [,,...
PAGE 177
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C5: ALIAS This keyword is used to convert a command input by an user or an input-file ("from") to a different command ("to"). This allows the XYGATEAC manager to define abbreviations for a subsystem or change a subsystem’s internal OBEY command to XAC’s <
PAGE 178
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C6: ALIAS_ALL_PROCESSES This keyword extends the ALIAS checking to any process that communicates with XAC, not just the initial OBJECT program the XYGATEAC process was configured to start. For instance, if the initially executed ACACL Command Entry contained ALIAS "OBEY" ">OBEY" and the initial OBJECT was SCF, then the SCF obey would be mapped to XAC’s internal obey command.
PAGE 179
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C8: ALIAS_XYGATEAC_PROCESSES This keyword prevents an XYGATEAC process from extending the ALIAS to any process whose object program file is in the XYGATEAC-installed subvolume by setting the ALIAS_XYGATEAC_PROCESSES to OFF. Syntax: ALIAS_XYGATEAC_PROCESSES {ON|OFF} ON The user input string will always be converted to the defined alias string.
PAGE 180
XYGATE® Access Control Reference Manual Appendix C: The ACACL File In Example 2 below, the user input does not get converted to the ALIAS text string because the object is in the XAC-installed subvolume. Example 2: Object in XAC-installed subvolume (ALIAS_XYGATEAC_PROCESSES OFF) COMMAND XYGATE-ALIAS USER XYPRO.IK OBJECT $VIK.XYGATEAC.XYGATEAC ! Object in XAC volume ACL $EVERYONE OPENSBYOBJECTS \*.$*.*.* START_LOGGED_ON ALIAS "F1" "#OUTPUT /COLUMN 10/ XYGATE-ALIAS; OBJ:$VIK.XYGATEAC.
PAGE 181
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C9: ALLOWCMD This keyword allows an XAC-controlled OBJECT program to be limited to a subset of user commands by specifying the commands that are permitted. ALLOWCMD also controls XAC internal commands such as <CONFIG") commands as well as the object program commands.
PAGE 182
XYGATE® Access Control Reference Manual Appendix C: The ACACL File <
PAGE 183
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C10: ALLOW_CHECK_ALIASES The keyword ALLOW_CHECK_ALIASES changes the order in which ALLOWCMD/DENYCMD and command ALIAS entries are evaluated. Without this keyword, XAC behaves as it always has. ALIAS entries are evaluated before ALLOWCMD/DENYCMD evaluation because it is assumed that the security administrator has set up the command ALIAS entries specifically for the environment.
PAGE 184
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C12: AUDIT_OUTPUT_COUNT This keyword defines the number of output lines that should be written to the audit logs configured to receive DETAIL audits after each command is processed. Syntax: AUDIT_OUTPUT_COUNT The Example below will log up to 14 lines of output after each command to any audit file configured for DETAIL audits. Example: COMMAND NIGHTLY-BALANCE DESCRIPTION "Generate balance, record balance, date info" USER PROD.
PAGE 185
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C14: AUDITUSER This keyword is followed by the list of users whose commands will be audited, assuming at least one audit file has been specified in the ACCONF file with the DETAIL sub-keyword, and the NOCOMMANDAUDIT keyword in the ACACL file has not been specified. If AUDITUSER keyword is omitted, all users will be audited. Syntax: AUDITUSER Example: COMMAND SPOOLCOM-255 DESCRIPTION "SPOOLCOM as SUPER.
PAGE 186
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C15: AUTHENTICATE_USER This keyword causes XAC to prompt for the userid and password and perform the user authentication. It is designed to be used with programs that do not prompt for userid and password before executing, such as PATHCOM, or with OSS audited XAC sessions. Syntax: AUTHENTICATE_USER { ON | OFF } Example: COMMAND SECURE-OSS-AUDITED-SHELL USER GROUP,USER OBJECT $SYSTEM.XYGATEAC.XYGATEOA ACL $EVERYONE OPENSBYOBJECTS \*.$*.*.
PAGE 187
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C16: BANNER_CONNECT This keyword displays a custom banner immediately upon a modem connect. This keyword and the BANNER_FIRSTIO keyword are mutually exclusive. The banner to display must be placed in an edit file that can be opened Read only by the userid that runs the XYGATEAC object file. Syntax: BANNER_CONNECT The Example below shows the banner displayed before the first TACL prompt is written.
PAGE 188
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C17: BANNER_FIRSTIO This keyword displays a custom banner before the OBJECT program’s first I/O. The banner to display must be placed in an edit file that can be opened Read only by the userid that runs the XYGATEAC object file. This keyword and the BANNER_CONNECT keyword are mutually exclusive. Syntax: BANNER_FIRSTIO The Example below shows the banner is prepended to the first prompt written to the terminal.
PAGE 189
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C18: BLANKPASSWORD This keyword causes all OBJECT program input to be scanned for the word PASSWORD. If PASSWORD is found, the first word (or token) following it is replaced by the number (#) symbol when written to any audit trail. Example: COMMAND SAFECOM DESCRIPTION "Safecom as SECURITY.ADMIN" USER 100,255 OBJECT $SYSTEM.SYSNN.
PAGE 190
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C20: BREAK_DISABLE_RETURN This keyword enables users to return to the previous process that was created XYGATEAC which is an ancestor of the BREAK Disabled process. Syntax: BREAK_DISABLE_RETURN {ON|OFF} ON If BREAK is disabled by an underlying process, it is returned to the previous process. OFF If BREAK is disabled by an underlying process, it remains disabled.
PAGE 191
XYGATE® Access Control Reference Manual Appendix C: The ACACL File INPUT "#PROCESSINFO /PROCESSID, PROGRAMFILE/" INPUT "#XPPD [#PROCESSINFO /PROCESSID/]" INPUT "FUP /NAME $QA452/" DONOTSTOP $*.*.PATHTCP2 BREAK_DISABLE_RETURN ON Example 1: Back to outer TACL($X37Q) from BREAK-Disabled process($QA451) $VIK IK 18> #PROCESSINFO /PROCESSID, PROGRAMFILE / #PROCESSINFO /PROCESSID, PROGRAMFILE / expanded to: $X37Q $SYSTEM.SYS45.TACL $VIK IK 19> == $X37Q is the outer TACL $VIK IK 20> $VIK IK 20> XAC575.
PAGE 192
XYGATE® Access Control Reference Manual Appendix C: The ACACL File Example 2: Back to inner TACL($X382) from non-BREAK-Disabled process($QA452) $VIK IK 28> #PROCESSINFO /PROCESSID, PROGRAMFILE / #PROCESSINFO /PROCESSID, PROGRAMFILE/ expanded to: $X37Q $SYSTEM.SYS45.TACL $VIK IK 29>xac575.xygateac br-ret-on-2 $VIK IK 1> #PROCESSINFO /PROCESSID, PROGRAMFILE/ XYGATEAC 5.75 XYPRO \N1 20991231 (see <
PAGE 193
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C21: CHANGEUSER_FROM and CHANGEUSER_TO The CHANGEUSER_FROM and CHANGEUSER_TO keyword pair are used to specify a list of users that can switch from the source userid to the destination userid without specifying a password for the destination userid. This operation is enabled by using the VULIB library which is supplied with XAC. The VULIB is attached to a copy of the object code program, usually TACL, using the XAC macro XAC_LIB_INSTALL.
PAGE 194
XYGATE® Access Control Reference Manual Appendix C: The ACACL File The VULIB library essentially extends the NSK intrinsic *.255 Userid privilege of crosslogon within the group without a password to any XAC authorized userid. However, the feature is more powerful with XAC because what the authorized userid gets is access to the destination userid(s) with a full audit trail (if configured).
PAGE 195
XYGATE® Access Control Reference Manual Appendix C: The ACACL File 4. You logon as SUPER.SUPER without using a password. 5. You finish your work as SUPER.SUPER and log back into TECH.RALPH. 6. You logon as SUPER.SUPER again and then logon as SUPER.OPER, which is permitted because SUPER.OPER and SUPER.SUPER are both on the same CHANGEUSER_TO line. 7. You execute a logoff, terminating the TACL.
PAGE 196
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C22: CHECKCONNECTION This keyword ensures modem cleanup by checking for the occurrence of a disconnect (modem hangup, Telnet disconnect, or Multilan disconnect) on a periodic basis, but only when no other I/O from another process running through XAC is pending to the device. Using this keyword will prevent a ‘PAUSED’ TACL from staying connected and logged on when a disconnect occurs.
PAGE 197
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C23: CMONIGNORECPU This keyword tells XAC to ignore the CPU selected by $CMON, and use the CPU in which the XYGATEAC process is running. Example: COMMAND TACL-255 DESCRIPTION "TACL as SUPER.SUPER" USER 255,255 OBJECT $SYSTEM.SYSNN.TACL ACL TECH.* START_LOGGED_ON NULLNULLSTOP TRACKUSERID OPENSBYOBJECTS $*.*.
PAGE 198
XYGATE® Access Control Reference Manual Appendix C: The ACACL File The above example would keep the "License" command from being executed by anyone using the FUP-SUPER ACACL Command Entry. Example: COMMAND SCF-DEV DESCRIPTION "SCF that doesn't allow you to touch production lines" USER 255,255 OBJECT $SYSTEM.SYSNN.SCF ACL $DEV FC# FCPROMPT "> " OPENSBYOBJECTS $SYSTEM.SYS*.SCF* REXP_ALLOWDENY DENYCMD ".*\$ATL[A-Z0-9]{1,3}.*" DENYCMD ".*\$ATM[A-Z0-9]{1,3}.*" ALLOWCMD ".
PAGE 199
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C26: DISCONNECT_ALL_PROCESSES This keyword causes XAC to process a modem disconnect request that has been received from any process that has been started during a session. Without this keyword, XAC only processes modem disconnect requests that have been received from the program named as the OBJECT in the ACACL entry. Example: ACACL Entry COMMAND STATIC-PATHWAY DESCRIPTION "STATIC Pathway Service" USER GROUP,USER OBJECT $SYSTEM.SYSTEM.
PAGE 200
XYGATE® Access Control Reference Manual Appendix C: The ACACL File C27: DONOTSTOP This keyword allows the specification of object files that are exempt from being stopped by XAC when the STOPONERROR keyword is specified and the error occurs or when a logoff occurs. A list of wildcarded object files may be specified, separated by spaces. Syntax: DONOTSTOP