Secur'Access ISM-UM Administrator's Guidesupport.bull.com/ols/product/system/gcos7/gcos7... · 1.2.3 SECUR'ACCESS V3 Components The SECUR'ACCESS V3 components are: • hardware •

Secur'Access

ISM-UM

Administrator's Guide DPS

7000/XTA

NO

VASC

ALE

7000

Applications

REFERENCE47 A2 07UC 00

DPS7000/XTANOVASCALE 7000

Secur'AccessISM-UM

Administrator's Guide

Applications

March 2006

BULL CEDOC

357 AVENUE PATTON

B.P.20845

49008 ANGERS CEDEX 01

FRANCE

REFERENCE47 A2 07UC 00

The following copyright notice protects this book under Copyright laws which prohibit such actions as, but notlimited to, copying, distributing, modifying, and making derivative works.

Copyright Bull SAS 1992, 2006

Printed in France

Suggestions and criticisms concerning the form, content, and presentation of thisbook are invited. A form is provided at the end of this book for this purpose.

To order additional copies of this book or other Bull Technical Publications, youare invited to use the Ordering Form also provided at the end of this book.

Trademarks and Acknowledgements

We acknowledge the right of proprietors of trademarks mentioned in this book.

Intel® and Itanium® are registered trademarks of Intel Corporation.

Windows® and Microsoft® software are registered trademarks of Microsoft Corporation.

UNIX® is a registered trademark in the United States of America and other countries licensed exclusively throughthe Open Group.

Linux® is a registered trademark of Linus Torvalds.

The information in this document is subject to change without notice. Bull will not be liable for errors containedherein, or for incidental or consequential damages in connection with the use of this material.

47 A2 07UC Rev00 iii

Preface

ADMINISTRATION OF GCOS 7 USERS FROM ISM-UM

TARGET AUDIENCE

If you are a security administrator in an INTEROP 7 context, this manual will provide you with the concepts and explanations necessary to use ISM-UM. It will enable you to centralize the administration of the users of a GCOS 7 system from ISM-UM. The catalog and the SECUR'ACCESS security base are updated automatically.

OTHER MANUALS AVAILABLE

SECUR'ACCESS Documents

SECUR'ACCESS Security Administrator's Guide ........................................... 47 A3 01BD SECUR'ACCESS Delegate Administrator's Guide.......................................... 47 A3 02BD SECUR'ACCESS User's Guide....................................................................... 47 A3 03BD SECUR'ACCESS Programming and Implementation Guide........................... 47 A3 04BD SECUR'ACCESS Evolution Guide .................................................................. 39 A3 05BD

ISM-UM/AccessMaster Documents

Stella Security Administrator's Guide .............................................................. 39 A7 79UU ISI7 .................................................................................................................. 47 A1 56UU General Presentation of AccessMaster........................................................... 39 A4 60RA ISM documentation: on line

Access to GCOS 7 Services

iv 47 A2 07UC Rev00

WHAT THIS DOCUMENT DESCRIBES

Only the SECUR'ACCESS functions used in ISM-UM to manage the GCOS 7 platform users are described in this document.

WHAT YOU WILL NOT FIND IN THIS DOCUMENT

This document does not deal with user management under ISM-UM on platforms other than GCOS 7. For details of this, please refer to the ISM-UM documentation.

47 A2 07UC Rev00 v

Table of Contents

1. About SECUR'ACCESS V3 .............................................................................. 1-1

1.1 WHAT IS THE AIM OF SECUR'ACCES V3 ............................................................... 1-1

1.1.1 How to Manage the Security of your DPS 7 Site .................................................... 1-1

1.2 MANAGEMENT OF THE USERS AND THE ENVIRONMENT .................................. 1-2

1.2.1 Definition .................................................................................................................... 1-2 1.2.2 General Architecture ................................................................................................. 1-3 1.2.3 SECUR'ACCESS V3 Components ............................................................................ 1-4 1.2.3.1 Hardware components ................................................................................................ 1-4 1.2.3.2 Software components.................................................................................................. 1-4

1.3 CONCEPTS AND DEFINITIONS ................................................................................ 1-5

1.3.1 ISM-UM Concepts...................................................................................................... 1-5 1.3.1.1 The person and his/her aliases ................................................................................... 1-6 1.3.1.2 The administrator role.................................................................................................. 1-6 1.3.1.3 User profile .................................................................................................................. 1-7 1.3.1.4 Management of access to the target system............................................................... 1-7

1.3.2 Elements Specific to SECUR'ACCESS .................................................................... 1-8 1.3.2.1 Protection of a GCOS 7 site ........................................................................................ 1-8 1.3.2.2 The different configurations......................................................................................... 1-9 1.3.2.3 GCOS 7 applications ................................................................................................... 1-9 1.3.2.4 SECUR'ACCESS security levels ................................................................................. 1-10 1.3.2.5 The password .............................................................................................................. 1-10 1.3.2.6 The confidential code .................................................................................................. 1-11 1.3.2.7 The cycle ..................................................................................................................... 1-11 1.3.2.8 The smart card ............................................................................................................ 1-11 1.3.2.9 The PIN ....................................................................................................................... 1-12 1.3.2.10 Choice of the language................................................................................................ 1-12 1.3.2.11 Rights under SECUR'ACCESS ................................................................................... 1-13 1.3.2.12 Who is the SECADMIN user ....................................................................................... 1-13


vi 47 A2 07UC Rev00

1.4 WHO ARE THE ACTORS IN SECURITY ................................................................... 1-13

1.4.1 Who is the SECUR'ACCESS Security Administrator ............................................. 1-14 1.4.2 Who is a Delegate Administrator ............................................................................. 1-14 1.4.3 Who is the Current User ........................................................................................... 1-14 1.4.4 What is a Fictitious User........................................................................................... 1-15 1.4.5 What is a Pseudo-user .............................................................................................. 1-16

1.5 INFORMATION BASES .............................................................................................. 1-16

1.5.1 Information Files under ISM-UM .............................................................................. 1-16 1.5.1.1 The SIB base............................................................................................................... 1-17 1.5.1.2 The AUDIT file ............................................................................................................. 1-17

1.5.2 The information files under SECUR'ACCESS......................................................... 1-17 1.5.2.1 The Security file ........................................................................................................... 1-17 1.5.2.2 The History file............................................................................................................. 1-17 1.5.2.3 The Audit file................................................................................................................ 1-18

2. Declaration of Administrators........................................................................ 2-1

2.1 HOW TO CREATE THE ISM-UM ADMINISTRATOR ROLE ..................................... 2-2

2.2 HOW TO EDIT AN ISM-UM SECURITY ADMINISTRATOR ROLE .......................... 2-2

2.3 HOW TO CREATE THE GCOS 7 SECURITY ADMINISTRATOR ROLE.................. 2-3

2.3.1 Declaring the Security Administrator on GCOS 7 .................................................. 2-3 2.3.2 Declaring the GCOS 7 Security Administrator in ISM-UM ..................................... 2-3

3. Declaration of Persons, Systems and Services ..................................... 3-1

3.1 GENERAL INFORMATION CONCERNING DECLARATIONS ................................. 3-1

3.2 HOW TO ACTIVATE ISM-UM .................................................................................... 3-2

3.3 HOW TO DECLARE A PERSON................................................................................ 3-3

3.4 HOW TO DECLARE A SYSTEM ................................................................................ 3-5

3.5 HOW TO DECLARE A SERVICE ............................................................................... 3-8

Table of Contents

47 A2 07UC Rev00 vii

4. Management of Registrations........................................................................ 4-1

4.1 HOW TO PERFORM REGISTRATION ...................................................................... 4-1

4.1.1 How to Initialize the Registration............................................................................. 4-2 4.1.2 How to Enter the Parameters ................................................................................... 4-4 4.1.3 How to Validate the Parameters............................................................................... 4-9 4.1.4 How to Resume an Incomplete Registration .......................................................... 4-10

4.2 HOW TO UNREGISTER ............................................................................................. 4-11

4.3 HOW TO MODIFY A REGISTRATION ....................................................................... 4-12

4.3.1 What Data Can Be Modified...................................................................................... 4-13 4.3.2 How to Delete a Data Element .................................................................................. 4-13

4.4 HOW TO SYNCHRONIZE REGISTRATIONS............................................................ 4-14

4.4.1 Which Data to Synchronize ...................................................................................... 4-14 4.4.2 How to Import Data ................................................................................................... 4-15 4.4.3 How to Export Data ................................................................................................... 4-16


viii 47 A2 07UC Rev00

Table of Contents

47 A2 07UC Rev00 ix

Appendix

A. SECUR'ACCESS Audit Status........................................................................ A-1

Glossary.................................................................................................................................... g-1

Index ................................................................................................................................... i-1


x 47 A2 07UC Rev00

Table of Contents

47 A2 07UC Rev00 xi

Illustrations

Figures 1-1 Administration of access to the Information System

by GCOS 7 Users via ISM-UM .................................................................................... 1-2 1-2 Architecture of GCOS 7 Administration Using ISM-UM .............................................. 1-3 2-1 Administrator Roles in the GCOS 7 Environment ....................................................... 2-1 3-1 Main Window of ISM-UM............................................................................................. 3-2 3-2 ISM-UM Users Window............................................................................................... 3-3 3-3 Create Person Window ............................................................................................... 3-4 3-4 System Window........................................................................................................... 3-6 3-5 Administration Parameters .......................................................................................... 3-7 3-6 Service Window........................................................................................................... 3-8 3-7 General Attributes Window.......................................................................................... 3-9 4-1 ISM-UM Registrations Window ................................................................................... 4-2 4-2 Create Registration Form Window .............................................................................. 4-4 4-3 GCOS 7 User Account Parameters Window............................................................... 4-5 4-4 GCOS 7 Login and Password Parameters Window.................................................... 4-6 4-5 Service Access Parameters Window .......................................................................... 4-7 4-6 Rights Window............................................................................................................. 4-8 4-7 Results of Registration ................................................................................................ 4-9 4-8 ISM-UM Window: Registration Report ........................................................................ 4-10 4-9 Modify Registration Form Window .............................................................................. 4-12 4-10 Synchronization Report Window ................................................................................. 4-15

Tables 1-1 Summary of the Elements Involved in User Security on a GCOS 7 Site..................... 1-19 A-1 SECUR'ACCESS Audit Status for SA7-ISM-UM (1/2) ................................................ A-1


xii 47 A2 07UC Rev00

47 A2 07UC Rev00 1-1

1. About SECUR'ACCESS V3

1.1 WHAT IS THE AIM OF SECUR'ACCES V3

SECUR'ACCESS V3 can be used to control user access to the GCOS 7 applications.

This product enables management of GCOS 7 access security:

• by direct management under GCOS 7 (these functions are described in the SECUR’ACCESS manuals)

• by centralized administration in ISM-UM (functions described in this manual)

1.1.1 How to Manage the Security of your DPS 7 Site

Before setting up your security system, you should consider the organization that you want to implement.

As the security administrator; you must:

• manage the specific features of each workstation • define the security parameters for each user.

If you were already working in a SECUR'ACCESS environment, the new SECUR'ACCESS V3 environment will take into account the old environment. For further information, see the SECUR'ACCESS Security Administrator’s Guide.

To set up maximum security on your site, you must:

• find out what the SECUR'ACCESS V3 product adds to your site. To do so, refer to the SECUR’ACCESS manuals.

• organize the security in accordance with the various tools offered by:

- the SECUR'ACCESS product - GCOS 7 (management of the catalogs, GCL environments and checklists

concerning the files) - AccessMaster.


1-2 47 A2 07UC Rev00

1.2 MANAGEMENT OF THE USERS AND THE ENVIRONMENT

1.2.1 Definition

In the ISM-USM environment, SECUR'ACCESS V3 enables management of the users of the GCOS 7 platform. The GCOS 7 user administration described in this manual is part of the ISM-UM product.

SECUR'ACCESS V3 can be used to manage:

• the users of the GCOS 7 catalog • the security data of the SECUR'ACCESS base users. • the user access rights regarding the applications.

As the security administrator, you manage the data required by the SECUR'ACCESS V3 product to control user access to the GCOS 7 applications.

IBM

GCOS 7

ISM-UM

Information System

Figure 1-1. Administration of access to the Information System by GCOS 7 Users via ISM-UM

About SECUR'ACCESS V3

47 A2 07UC Rev00 1-3

1.2.2 General Architecture

SECUR'ACCESS V3 enables centralized administration of the users recorded in the bases (base and catalog). The Figure below shows the architecture of a GCOS 7 site using ISM-UM.

GCOS 7 UNIX

OPEN 7

SERVERIUM-SA7 AGENT

SECUR'ACCESS

ISM-UM

CatalogSA7 Base

SIB

CLIENTIUM-SA7 AGENT

Figure 1-2. Architecture of GCOS 7 Administration Using ISM-UM

This diagram shows the two basic parts of the SECUR'ACCESS V3 product:

• the GCOS 7 system and its security agent SECUR'ACCESS

• the UNIX system and ISM-UM AccessMaster


1-4 47 A2 07UC Rev00

1.2.3 SECUR'ACCESS V3 Components

The SECUR'ACCESS V3 components are:

• hardware

• software

1.2.3.1 Hardware components

SECUR'ACCESS V3 brings together the following systems:

AccessMaster Station under AIX from version 3.2.5 onwards. This station includes ISM-UM and the ISM Framework.

DPS 7000 with GC0S 7-V7 from Technical Status 7356 onwards, host system of OPEN 7

and SECUR'ACCESS.

The cards supported by ISM-UM/AccessMaster. These cards have the TB100 mask.

1.2.3.2 Software components

The following software components are necessary to centralize GCOS 7 security under ISM-UM:

On the AccessMaster Station

ISM-UM administration module of ISM-AccessMaster. ISM-UM can be used to manage:

- the information in a database, - the people and their privileges, - the types of systems.

AccessMaster this ISM component handles authentication of the users of

the protected workstations. This authentication is performed: - either by means of a smart card - or using an identifier and a password - or by a combination of these two solutions.

ISM FrameWork core of ISM essential for the operation of ISM-UM. The ISM

FrameWork handles communications management using various protocols.

Software keys are necessary to use the ISM Framework.

ORACLE/INGRES handles management of the database.


47 A2 07UC Rev00 1-5

IUM-SA7 IUM-SA7 is the software component that allows the client/server dialog between GCOS 7 and UNIX. The client part of IUM-SA7 is integrated in ISM-UM.

RPC-DCE protocol used by the client IUM-SA7 to dialog with GCOS 7.

On the DPS 7000

OPEN 7 GCOS 7 environment under UNIX.

GX-RPC or Remote Procedure Call on GCOS 7 for executing a procedure located in a different address space from the caller in a way that is transparent for the application.

SECUR'ACCESS used to control access to the GCOS 7/SECUR'ACCESS

applications:

- includes administration and access control modules

- provides the interfaces required to administer the GCOS 7 users and the security bases.

IUM-SA7 its GCOS 7 part consists of an RPC server called SA7SRV.

1.3 CONCEPTS AND DEFINITIONS

IMPORTANT

An ISM-UM service is the equivalent of a project in the GCOS 7 catalog.

Every service is defined in relation to ISM-UM and GCOS 7.

1.3.1 ISM-UM Concepts

For further details concerning the ISM-UM concepts; please refer to the General Presentation of AccessMaster.

The following concepts are used in user management in a protected ISM-UM environment:

• the person and his/her aliases • the role • the profile • management of access to the target system.


1-6 47 A2 07UC Rev00

1.3.1.1 The person and his/her aliases

Every user of a service on a target system is a person.

An alias associates a person with a set of attributes. The alias cannot exist on its own like an independent person. As the security administrator, as soon as you have assigned an alias to a person, ISM-UM treats this alias as a person in the organization.

The alias is used to:

• represent a given individual in two different organizations.

• associate several user profiles with a given individual. The person, who fulfills several functions within a company, therefore obtains different access rights to the target systems.

• record a person in different service lists.

The ISM-UM names of the person and his/her aliases have to be different. However, the principal connection identifier of an alias is always the ISM-USM name of the person.

1.3.1.2 The administrator role

This role is characterized by:

• its type (list of actions possible on certain types of object)

• the domain to which it applies (subtree of the model)

• the list of the people who fulfill this role

As the security administrator, you define:

• the list of the rights concerning: - each of the types of objects contained in the bases - the functions that do not directly involve the objects.

• the subset of the base objects to which the role applies.

You must have at least one administrator role. Several roles can be assigned to you. The roles may be different for the person attribute and the aliases.

The following list of roles is delivered with the product and is not exhaustive. The functions attached to the roles can be modified. The six roles below determine the security actions that their bearers are authorized to perform:

• super-administrator • person administrator • resource administrator • registration administrator • local registration administrator • auditor


47 A2 07UC Rev00 1-7

1.3.1.3 User profile

The profile is a set of attributes assigned to a person or an alias. The profile:

• contains a reference to a user role

• can be used to define a user role.

A predefined role is attached to every profile.

Among the attributes assigned to a person, there is a subset that forms the profile of the person. This profile defines a set of privileges and general attributes which determine the person's rights on a protected workstation.

The user profile is used to define:

• the list of the workstations which the person is authorized to use for connection • the authentication method that the person can or must use to log on and benefit from

the rights of this profile • the list of times when connection is authorized • the audit level for the person's actions on the workstation.

1.3.1.4 Management of access to the target system

The management of access to the GCOS 7 target system managed by ISM-UM is based on the two following functions:

• management of the resources • management of the functions

Management of the resources

Management of the resources involves declaring the:

• systems • services

Management of the functions

Management of the registrations for the target software involves:

• registration of the users for services • cancellation of the registrations.

When you use the registration function, you authorize a person to access a service or not, as the case may be. With the registration, you associate a Person, an Alias or a Group of Persons with a Service or Group of Services.

You can remove the link between these objects by unregistration.

Unregistration can be used to stop a person from accessing services.


1-8 47 A2 07UC Rev00

The relation between persons and services is managed using objects called registration forms.

The security data must also be updated in the databases on remote machines. For example, when you register a user for a given service, this registration must be transmitted to the software agents on the local machines. These agents then update the databases on the target systems.

After validation, the registrations are transmitted to the remote agents which update the data on the target systems.

Under ISM-UM, a card change is indicated by a form modification.

1.3.2 Elements Specific to SECUR'ACCESS

The GCOS 7 service users can only be administered if security is activated on the GCOS 7 system. Ask the system administrator to activate the security at system level.

1.3.2.1 Protection of a GCOS 7 site

The three following options are possible for the protection of a DPS 7 site:

• protecting all access to the applications (TDS) and batch processing (IOF). Only the first option is mandatory for administration from ISM-UM.

• reserving user management for the security administrator

• protecting the system console.

These options are implemented by the GCOS 7 CONFIG tool.

Security of the system console

The system console must be protected by logical access control if it is not in a location with physical access control (key or access code).


47 A2 07UC Rev00 1-9

1.3.2.2 The different configurations

SECUR'ACCESS is divided into several modules that can be commercialized separately. Each of these modules has a Marketing Identifier (MI). The level of functionality depends on the MIs present.

SECUR'ACCESS components

The two main MIs provide the following functions:

• SECUR'ACCESS administration and control modules with authentication based on the password. However, there is an administration option for protecting administration by means of a card. In this case, you and the delegate administrators must each have a card.

• Management of smart cards for all the users and management of access to GCOS 7 applications at card level.

SECUR'ACCESS administration configurations

The two levels of security on a site are:

CONFIGURATION 1 password level; cards are not used on the GCOS 7 system.

CONFIGURATION 2 card level; the users can have cards.

Each of these levels influences the behavior of the SECUR'ACCESS software. The different actions possible described in this manual make reference to these parameters.

1.3.2.3 GCOS 7 applications

The GCOS 7 applications are :

• either the IOF (Interactive Operation Facility) subsystem

• or a TDS (Transactional Distributed System)

As the SECUR'ACCESS security administrator, you must define a level of security for each application. This level can be chosen using the parameter management function in the main SECUR'ACCESS administration menu.


1-10 47 A2 07UC Rev00

1.3.2.4 SECUR'ACCESS security levels

Definition

The SECUR'ACCESS security level determines the degree of access control, depending on the sensitivity of the application. There are three security levels:

Level 0 : control as in the catalog

Level 1 : password checked by SECUR'ACCESS and catalog control

Level 2 : mandatory access control with a smart card. For level 2 protection of your site, you must install the card access module on the workstation to be protected.

Example

A user may have a password and a smart card to access applications with different security levels. If a level 1 workstation is equipped with a card access module, the password does not have to be entered if the card is used.

Use

There are 4 points for defining the security level:

Access to the site defined in the general parameters of SECUR’ACCESS.

Access to applications you define and assign the control level at the time of connection to the application.

Programmed control in the GCOS 7 application, an extra control point other than

the check at connection can be defined.

Access to the project you can impose the minimum level for access to the GCOS 7 project.

For a given check, the most restrictive of these parameters is selected.

1.3.2.5 The password

Definition

The password is the secret code which a user must enter to access a system.

Use

On a traditional terminal the password is checked against the one in the GCOS 7 catalog by SECUR’ACCESS.


47 A2 07UC Rev00 1-11

On a workstation The main password is checked by AccessMaster. Connection to a GCOS 7 system is achieved by means of this password defined via AccessMaster.

1.3.2.6 The confidential code

Definition

This is a secret code linked to use of the smart card under SECUR'ACCESS. This code is only used and checked by SECUR'ACCESS.

Use

The confidential code is not used in the administration of GCOS 7 by ISM-UM. AccessMaster requires the use of the PIN (Personal Identifier Number).

1.3.2.7 The cycle

Cycle is the name given in SECUR'ACCESS administration to the period of validity of a password or confidential code. For further information, see the SECUR'ACCESS Administrator's Guide.

The cycle concept should be reserved for users of traditional terminals controlled by SECUR'ACCESS.

1.3.2.8 The smart card

Definition

The smart card enables you to identify yourself without having to memorize your identifiers.

Different types of cards

To ensure continuity of service on sites already equipped with SECUR'ACCESS, you can use the following smart cards on traditional terminals:

M6 card with a private algorithm. The code in SECUR'ACCESS is M6.

SCOT 60 and 110: cards with the DES algorithm. These two types of card have

the following codes, respectively: MC and MD.


1-12 47 A2 07UC Rev00

On workstations controlled by SECUR’ACCESS

TB100 : multiservice card with the DES algorithm. The code of this type of card in SECUR'ACCESS is MQ.

Use

A smart card may be damaged or lost. SECUR'ACCESS enables you to assign another card to a user, automatically prohibiting use of the lost card. AccessMaster enables you to assign another card to a user, thus automatically prohibiting use of the lost card.

The smart card unlocking function is only possible with traditional terminals administered by SECUR'ACCESS.

1.3.2.9 The PIN

Definition

The PIN is the secret code associated with the smart card. The card itself checks this code.

The smart card records in its memory each successful or unsuccessful presentation of the PIN.

Use

You must use the PIN with AccessMaster and the TB100 card.

1.3.2.10 Choice of the language

Definition

A specific language is assigned to each user. This language is defined by default at the level of the general SECUR'ACCESS parameters. It is an attribute of the user.

Use

The language code is the code defined by the ISO standard, as shown below:

SECUR'ACCESS ISM-UM

250 for French fr for French 826 for English en for English

If the language you require is not defined in SECUR'ACCESS, contact your supplier to obtain the missing language.


47 A2 07UC Rev00 1-13

1.3.2.11 Rights under SECUR'ACCESS

Access is granted to an application if authentication and the authorization check are successful. The authorization check is performed in the following way:

• the application requests a right • the user must possess that right.

You can request surveillance of the use of certain rights. Some rights are predefined for access to GCOS 7 applications.

The right is completed by ten locks. The configuration of a lock associated with an application right must be defined after consulting the application development teams.

The lock zone is used to indicate details concerning the right. For example, if the right authorizes access to an application, the locks can be used to distinguish between users who can use a specific function in the application and those for whom access will be prohibited.

The right is expressed as a 3-digit number: 799 is reserved for SECUR'ACCESS rights.

A user's rights are defined in ISM-UM when a person is registered for a service.

1.3.2.12 Who is the SECADMIN user

The SECADMIN user is a user who can access IOF via the SECUR'ACCESS access control in the event of a problem. Access to IOF is controlled as for an ordinary user, but if necessary, it can be done in a degraded mode:

• control with card and confidential code if access to IOF requires it • in the event of a problem: control using password • if there is a problem for access to the catalog: no control.

You are advised to give the SECADMIN user a strong 12-character password which is only to be used in extreme cases where the database has been destroyed or there has been a physical error on a disk.

1.4 WHO ARE THE ACTORS IN SECURITY

The security administrator of your site can manage the specific SECUR'ACCESS features via the AccessMaster application. In the security organization, SECUR'ACCESS involves the following actors:

• the security administrator • the delegate administrator • the user • the fictitious user • the pseudo-user.


1-14 47 A2 07UC Rev00

1.4.1 Who is the SECUR'ACCESS Security Administrator

The SECUR'ACCESS security administrator can manage security on the GCOS 7 site using the administration functions specific to SECUR'ACCESS. This administrator is a person registered in the SA 7 service as security administrator on the ISM-UM administration function.

As the security administrator:

• you can access the full SECUR'ACCESS administration menu.

• you can validate the operations performed by a delegate administrator.

The security administrator is a concept specific to SECUR'ACCESS which:

• is registered in the SA 7 service under ISM-UM

• can be created or modified in ISM-UM

• can only be used in SECUR'ACCESS.

NOTE: At least two security administrators must be active.

1.4.2 Who is a Delegate Administrator

A delegate administrator is a user who has access in SECUR'ACCESS to a restricted menu concerning the users declared under his/her responsibility.

To appoint a delegate administrator, use the registration form modification function under ISM-USM.

1.4.3 Who is the Current User

The current user is declared without a manager, or under the responsibility of a delegate administrator.

The current user possesses authorization for the IOF or TDS application. He/she has access to the certain functions enabling him/her:

• on a workstation controlled by AccessMaster :

- to change the password

- to change the PIN code


47 A2 07UC Rev00 1-15

• on a terminal controlled by SECUR'ACCESS :

- to change the password

- to change the PIN code

- to unlock the card

- to carry out authentication by witness

The current user is a specific SECUR'ACCESS concept which may be:

• created or modified in ISM-UM • used in SECUR'ACCESS.

1.4.4 What is a Fictitious User

The fictitious user is a concept specific to SECUR'ACCESS which is used to manage temporary replacement cards. The fictitious user is:

• created or modified in ISM-UM • usable in SECUR'ACCESS.

In SECUR'ACCESS, temporary replacement cards are:

• planned and taken into account in the security files

• declared and assigned to fictitious users who have no name, forename, expiry dates or authorizations and do not exist in the GCOS 7 catalog.

• inactive in the system until they are activated.

To activate the temporary replacement card you must sign the data of these cards.

A delegate administrator can activate a temporary card if the fictitious user associated with this card is declared under his/her responsibility.

This activation:

• is performed for a user who has forgotten his/her card • causes use of the forgotten card to be blocked.

The user keeps his/her confidential code and authorizations. If he/she uses the PIN, he/she must use the one belonging to the temporary card.

You impose the duration of the temporary card's activation by means of a parameter. Choose a short activation period. When the original card is retrieved:

• deactivate the temporary card and the replaced card will recover the functions that you suspended.


1-16 47 A2 07UC Rev00

1.4.5 What is a Pseudo-user

The pseudo-user is a concept specific to SECUR'ACCESS.

• Printer-type pseudo-users, also called passive users, are necessary to ensure consistency with the GCOS 7 catalog.

• They log on to the DPS 7 using the same rules as normal users.

Pseudo-users cannot undergo security checks because they do not possess any means of dialog with the host (no keyboard).

Pseudo-users can be:

• created and modified in ISM-UM

• used in SECUR'ACCESS

When pseudo-users log onto an application without being passive, they are:

• subjected to a mandatory password check

• created with an initial password which is modified using the modification function of the administration facility. This password is managed by SECUR'ACCESS. The password of the catalog is made up of spaces.

NOTE: For security reasons, pseudo-users must be declared under a project that has no access to IOF.

1.5 INFORMATION BASES

Security management makes use of the information files under:

• ISM-UM

• SECUR'ACCESS

1.5.1 Information Files under ISM-UM

There are two types of information files under ISM-UM:

• the databases • the audit file.


47 A2 07UC Rev00 1-17

1.5.1.1 The SIB base

The SIB (Security Information Base) is an ORACLE or INGRES base that collects the objects necessary for ISM-UM administration.

1.5.1.2 The AUDIT file

Audit traces are generated on the protected workstations for specific types of events. These traces can be used to find out:

• when a workstation was started up • a user's attempts to access a specific application.

By means of file transfer, these events are:

• collected in the administration center • recorded in the audit files.

The Audit function can be used to:

• generate the audit files from any workstation in the distributed system

• extract information from the audit files

• prepare reports on all the events regarding security.

1.5.2 The information files under SECUR'ACCESS

All the sensitive information is encrypted and undergoes an integrity check.

1.5.2.1 The Security file

The Security file contains the system's general security data and the data concerning the users of the site.

You can consult this file using the SECUR'ACCESS consultation option.

1.5.2.2 The History file

This file contains the successive statuses of the user's data recorded before each modification. This means that it is possible to consult the previous statuses of this data for each user.

This file can be consulted using the SECUR'ACCESS consultation option.


1-18 47 A2 07UC Rev00

1.5.2.3 The Audit file

The Audit file collects all the abnormal events in the system involving:

• the control points

• the administration functions.

It records all the administration actions. If certain rights are put under surveillance, passage through the control points where these rights are required is therefore recorded.

The data collected can be used to find out:

• the origin of the event (terminal and network node)

• the date and time

• the identification of the user

• the type of event

The Audit file can be consulted in SECUR'ACCESS.

As a security administrator, you can access all the events. The delegate administrator can only consult the events linked to the users under his/her responsibility.


47 A2 07UC Rev00 1-19

Table summarizing the elements involved in the security of a GCOS 7 site

The table below shows the various elements involved in user security on a GCOS 7 site and the locations of these elements or concepts.

Table 1-1. Summary of the Elements Involved in User Security on a GCOS 7 Site

SECUR'ACCESS under GCOS 7 AccessMaster under UNIX

SECUR'ACCESS elements - Security of a site - Configuration tools - GCOS 7 application - Security levels - Password - Confidential code - Cycle - Smart card - Language - Rights - Privileged user

Concepts: - Person and alias - Role - Profile Access management - Password - Language - List of authorized services

Security actors The security actors are created under ISM-UM and used under SECUR'ACCESS

Actors created under ISM-UM - Pseudo-user (printers) - Fictitious user (temporary replacement card) - Current user (Card change) - Delegate administrator (no impact on security) - Security administrator (full menu: management of users)

Information Files - Security File of users - History - System event audit

Information Files - Databases - Audit file of workstations


1-20 47 A2 07UC Rev00

47 A2 07UC Rev00 Erreur ! Document principal seulement.-1

2. Declaration of Administrators

The figure below shows the operation of security administration:

• under ISM-UM, you can use the ISMADM administrator (1) defined when ISM-UM was installed.

• under GCOS 7/SA 7, you need a SECUR'ACCESS administrator (3), e.g. ADM SA 7.

• between ISM-UM and GCOS 7, to perform administration queries, you need the administrator ADM G7 (2).

ISM-UM GCOS 7

SA 7 AdministratorADMSA 7

ISM-UM Administrator

ISMADM

Name: ADMG 7

1

2

3

SA 7

Figure 2-1. Administrator Roles in the GCOS 7 Environment

The names indicated in this figure are given as examples. The ADMG 7 administrator has the same functions as ADMSA 7 but is defined under ISM-UM.

The ADMSA 7 and ADMG 7 administrators can be declared in parallel and there is no imposed order of declaration.


Erreur ! Document principal seulement.-2 47 A2 07UC Rev00

2.1 HOW TO CREATE THE ISM-UM ADMINISTRATOR ROLE

To create an administrator role under ISM-UM:

1. Select the node under which you wish to create this administrator role

2. Select the User icon. The window is displayed.

3. Select the Create / Administrator role function in the Users window. The Administrator role window is displayed.

4. Fill in the fields in the window displayed as follows:

Type Select the Type button. The list of Types is displayed on the

screen.

- Select in the Person Administrator list.

Name (default value = type of role) Enter the name which defines the role in your organization.

Comments To define the security administrator role, enter a text

describing the role.

Holders Displays a list of the names of the persons/aliases to which the selected role has been assigned.

5. Click on the Edit button to modify the list of holders. The window displayed shows

the list of the holders of the selected role already defined.

2.2 HOW TO EDIT AN ISM-UM SECURITY ADMINISTRATOR ROLE

To edit an ISM-UM security administrator role:

1. Select the administrator role.

2. Select the Edit / Details command in the Users window or, more simply, click twice on the administrator role.

Declaration of Administrators


2.3 HOW TO CREATE THE GCOS 7 SECURITY ADMINISTRATOR ROLE

2.3.1 Declaring the Security Administrator on GCOS 7

The SECADMIN security administrator is created when the SECUR'ACCESS software is installed under GCOS 7. You are strongly advised to create a security administrator dedicated to the administration of GCOS 7 under ISM-UM who is different from the SECADMIN administrator.

To declare this administrator as SECUR'ACCESS security administrator, who may be SECADMIN, you must:

• log on to the SECUR'ACCESS administrator function (TDS SA 7)

• activate the SAMENU transaction

• choose option 1 in the main menu

This administrator:

• must not be blacklisted

• must have a password different from the site's initial password

For further details on creating the security administrator under SECUR'ACCESS, see the Security Administrator's Guide.

2.3.2 Declaring the GCOS 7 Security Administrator in ISM-UM

This declaration takes place in the ISM-UM resources administration function when you define the GCOS 7 system. You must then indicate the name and password of the administrator defined on GCOS 7 (see Declaring the Security Administrator on GCOS 7)




3. Declaration of Persons, Systems and Services

3.1 GENERAL INFORMATION CONCERNING DECLARATIONS

In ISM-UM, the following entities must be defined:

• the GCOS 7 system • the service • the person.

A system represents the software to be updated (operating system, server or application) and the target machine that supports it.

Service

A service represents a software entity for which you register the users. In general, the service corresponds to the user group concept (UNIX) or project concept (GCOS 7). Full description of software is therefore performed using a set of services linked to a system.

Person

The person must be associated with a GCOS 7 user.

The administration of access to the target systems managed by ISM-UM is based on the registration forms.

The administrator registers a person for a service by creating a registration form containing all the parameters required to create the user of the software.



3.2 HOW TO ACTIVATE ISM-UM

To activate ISM-UM, you can choose one of two methods:

• In the main ISM window, select the ISM-UM icon.

• Under UNIX, enter the command ium.

The main window of the ISM-UM application is displayed.

Figure 3-1. Main Window of ISM-UM

Declaration of Persons, Systems and Services


3.3 HOW TO DECLARE A PERSON

A Person is the name given to the unique representation of a physical person in the SIB.

To declare a person:

1. Select the Users icon. The ISM-UM Users window is displayed.

Figure 3-2. ISM-UM Users Window

2. Select the organization (O) or suborganization (UO) under which you wish to create the person.

If this organization (or suborganization) does not exist, you can create it.



3. In the menu bar, select Create / Person. The Create Person window is displayed.

Figure 3-3. Create Person Window

4. Fill in the fields in the window.

For further information about the parameters in this window, see the ISM-UM on-line help which can be accessed by selecting the Help button at the bottom of the screen.

A check is made that the attributes are unique in the database when the person is created.

5. To open the other person definition windows, select the buttons on the right of the window.

- Profile... - Card... - Password. - Login names. - Alias.. - Roles.. - More..

6. To create the person in the SIB without updating the GCOS 7 bases, select the

Apply button.



3.4 HOW TO DECLARE A SYSTEM

The system object contains the network characteristics enabling ISM-UM to access this system. The target is generally updated by means of an agent located on the target machine. Depending on the type of target to be updated, the system contains:

• an Internet alias

• a domain name

• for other types of host systems, the system identifier.

The system object also contains optional values used as default values for the registration form parameters when persons are registered for the services in this system (particularly for non-interactive grouped registrations).

The systems are defined using a set of:

• standard attributes common to all systems

• specific attributes that depend on the type of system

Creation of a system (except for targetless systems) triggers access to the target. This access enables the operation of the link between the machine supporting ISM-UM and the machine supporting the system managed to be checked.

Declaration of a System

To declare a system (SY):

1. Select the organization under which you wish to create the system.

2. Use the Create / System command in the Resources window. The Create System window is then displayed.



Figure 3-4. System Window

3. Fill in the fields in the window obtained as follows:

Name Enter the identifier of the system which must be unique in the SIB (mandatory).

Comment Enter a description of the system. Free text field.

Type Choose the type of system in the menu proposed: GCOS 7.

System identifier The behavior of this field depends on the type of system

selected above. For a GCOS 7 system, this is the identifier of the site in the network, e.g. BY1D. Note that this name is in capital letters.



In the top right-hand corner of the screen, there is a set of buttons that depends on the type of system and gives access to the supplementary system definition windows.

NOTE: The Login and Password Parameters button is not accessible when a GCOS 7 system is involved.

4. Select the Administration Parameters button. The Administration Parameters window is displayed.

Figure 3-5. Administration Parameters

5. Fill in the following mandatory fields:

Administrator name Enter the name of the security administrator that you have defined on this GCOS 7 system.

Administrator Password

Enter the password of the security administrator that you have defined on this GCOS 7 system.



3.5 HOW TO DECLARE A SERVICE

To declare a service (S):

1. Select the organization under which you wish to create the service

2. Select the Create / Service command in the Resources window. The main Service declaration window is then displayed.

Figure 3-6. Service Window

3. Fill in the fields as follows:

Service Name Enter the name of the service. It must be unique in the SIB. You can modify this field later on. (15 characters maximum). This service name is associated with a GCOS 7 project name (see General Attributes window).

Comment Enter a description of the service. Free text field.

System / Server Name Enter the name of the system to which this service is linked.

Direct input is impossible:

1. To obtain a list of the system names already declared in the SIB, click on the list button to the right of the field.

2. Select a system.

3. To close the dialog box and transfer the system to the

main window, click on OK.



Visibility Choose the value:

- Private to enable the service to be used only the administrator of the domain to which the service belongs.

- Public to enable every administrator to use this service.

4. To associate the IUM service with a GCOS 7 project, select the General Attributes

button. You can then choose the name of the GCOS project. The default value for the project name is the name of the service.

Figure 3-7. General Attributes Window

5. Select the List icon to the right of the Project field. The list of projects is displayed.

6. Select a project in the list.

7. To validate your choice, select the OK button.




4. Management of Registrations

4.1 HOW TO PERFORM REGISTRATION

Registration may be interactive or automatic.

In automatic mode, the registration form is filled in by taking the default values entered when the person, service or system was defined.

In interactive mode, enter the necessary parameters during the registration process. In this case, the registration form proposes predefined values that you can accept or modify as you require.

A report is drawn up before you obtain the registration parameters. Its status changes during the registration process.

The ISM-UM Registrations window can be used to perform all the types of registration or unregistration offered in ISM-UM.



4.1.1 How to Initialize the Registration

In interactive mode, to create, update, view and cancel relations between persons, aliases, groups of persons, services and groups of services, use the ISM-UM Registrations window.

To do so:

1. Select the Registrations icon in the main ISM-UM window. The ISM-UM Registrations window is then displayed.

Figure 4-1. ISM-UM Registrations Window

This window contains:

• a menu bar with the following options:

- File - Edit - Selection - Display - Options - Help

Management of Registrations


• Six icons

These icons represent thedifferent types of registration which you can carry out:

- a person with a group of persons - a person for a service - a person for services - a group of persons for a service - a group of persons for a group of services - a service with a group of services

• two lists

Each list possesses a title which indicates the type of registration that you have selected by selecting an icon.

• five selection buttons

Use these buttons to perform the following operations:

- Register - Unregister - Edit form - Register in the list on the right of the screen - Register in the list on the left of the screen

• two input areas

If you need to enter a new element in a list, use the input area located under the list concerned.

For GCOS 7, the usual operation of administration involves registering a user for a project, i.e. in the IUM sense, registering a person for a service.



4.1.2 How to Enter the Parameters

To enter the registration form parameters, follow the procedure described below:

1. Select the second icon from the top. It represents the link between a Person and a Service. The two lists, Persons and Services, display the elements already recorded.

If your access rights allow you to perform this operation, the system creates a registration report. The registration process has begun but has not yet finished: the parameters in the registration form have not been validated by the administrator, so they have not yet been transferred onto the target system. The system waits for the registration parameters to be sent to it. At this stage, the registration report status is: To do.

2. Select on the Register button to perform registration. The Create Registration Form window is then displayed.

Figure 4-2. Create Registration Form Window

This window contains the following parameters:

Login Name: Mandatory parameter. This is the user identifier which will be registered in the catalog and security base of the GCOS 7 system.

Password: Mandatory parameter. This is the password used for the

connection to GCOS 7. The display of the password depends on the configuration of this parameter. For further information, see the ISM-UM User's Guide.

Comment: Free text field. Modified By: Identifies the administrator who performed the last

modification. Modification Date: Field filled in automatically by ISM-UM.



3. In the Create Registration Form window, select the User Account Parameters button. The User Account Management window is then displayed.

Figure 4-3. GCOS 7 User Account Parameters Window

This window contains the following fields:

Real Name: Name of the user.

Forename: First name of the user.

Default Project: Mandatory parameter.

User Code: This parameter defines the type of administrator for SECUR'ACCESS. To open a fixed list of possible values for this parameter:

1. Select the button located in this field. 2. Select the required value among the proposed values:

Administrator, Delegate, Normal, Replacement, Passive. The default value is Normal.

Language Code: This parameter defines the code for internationalizing and

localizing the messages in ISM-UM. To open a fixed list of possible values for this parameter:

1. Select the button located in this field. 2. Select the required value among the proposed values: EN

or FR. The default value is FR.

Comment Free text field.



Expiry Date: Enter the expiry date of the user account. The format of the date is defined under ISM-UM. The default value is an empty field, indicating that there is no expiry date.

Billing: Optional parameter. No default value.

4. In the Create Registration Form window, select the Login and Password Parameters button. The Login and Password Parameters window is displayed.

Figure 4-4. GCOS 7 Login and Password Parameters Window

This window contains the following fields:

Serial Number Optional parameter. No default value. To unlock the Card Attributes button, enter the serial number of the smart card assigned to the user in this field.

Code Cycle Optional parameter. 3 numeric characters. This is the

identifier of a profile of the confidential code change rules linked to the smart card.

For users possessing a card but who only use it on terminals not controlled by AccessMaster, this value is necessary. The cycle must be defined beforehand in SECUR'ACCESS. The value -1 means that this parameter has not been defined.

Password Cycle Optional parameter. 3 numeric characters. This is the

identifier of a profile of the confidential code change rules linked to the smart card and managed by SECUR'ACCESS. The password cycle is only used for users working on terminals not controlled by AccessMaster. If the field is not filled in, the value zero is transmitted. The value -1 means that this field has not been filled in.



5. In the Create Registration Form window, select the Service Access Parameters button. The Service Access Parameters window is then displayed.

Figure 4-5. Service Access Parameters Window

This window contains the following parameters:

Black-List The default option for this button is non-selected. To register a user in the black-list, select the Black-List button.

Word Service Optional parameter. No default value. Enter a maximum of 20

alphanumeric characters. This parameter is returned after access checks under SECUR'ACCESS.

Rights Optional parameter. No default parameter. For standard IOF users on protected GCOS 7 systems, enter the value 799 in this field.

The syntax is as follows: - 3 numeric characters, followed by a 10-character lock

(space or 1). Responsible Optional parameter. 12 alphanumeric characters maximum.

This is the identifier of the delegate administrator responsible for the user concerned by the registration. This delegate must be registered for the SA 7 service of the GCOS 7 system involved.



Responsible Substitute Optional parameter. 12 alphanumeric characters maximum. If the registration concerns a delegate administrator, you can indicate the name of the substitute. This substitute must be registered as a delegate administrator for the SA 7 service of the GCOS 7 system concerned. You can cancel a substitute in this field under ISM-UM or SECUR'ACCESS.

6. To open the Rights window, select the list icon displayed to the right of the Rights

field.

Figure 4-6. Rights Window

7. To add rights, select the Add button. A window is displayed to allow you to enter the these new rights.

ISM-UM updates the SIB and the remote security databases.

The registration reports are updated after the last registration. If the local agent is unable to register the selected person on the target system, the error condition appears in the registration report.



4.1.3 How to Validate the Parameters

After input of the parameters in the different windows:

• In the Create Registration Form window, select the OK button.

A registration form is created in the SIB and a request is sent to the target agent. The result of the registration is displayed in the dialog box below.

Figure 4-7. Results of Registration

At this stage, the status of the registration in the report is:

• Created in ISM-UM;

• Created on target system.



4.1.4 How to Resume an Incomplete Registration

Each registration/unregistration generates a report which guarantees that the operation has been taken into account by ISM-UM. When the operation is finished (i.e. when the registration parameters have been transmitted correctly to the target agent), the report is no longer useful and can be deleted. However, until these parameters have been sent correctly, the registration report reminds you that an action has been started but not finished. This report serves notably for the management of incomplete registrations/unregistrations.

To display the Registration Report window, select the Report icon in the main ISM-UM window.

Figure 4-8. ISM-UM Window: Registration Report

To continue a registration interrupted voluntarily or by a fault:

1. In the menu bar, select the Edit option.

2. To continue this registration, select Register again. The Create Registration Form window is displayed.



4.2 HOW TO UNREGISTER

The Interactive Mode allows you to follow the unregistration step by step.

1. Select the required objects in the two lists.

2. Select the Unregister button.

If a person is registered several times for the same service (with different identifiers):

• ISM-UM opens a selection box listing the identifiers, with each corresponding to a distinct registration form.

• Select the registration that you wish to cancel.

Unregistration withdraws from a given user the right to access a given service. The person's registration is canceled both in the target service and in the SIB.

However, unregistration does not close the account on the target system if the account is also used to access another service.

The user is removed from the catalog and GCOS 7 security base when the last registration, i.e. the last user-project link, is canceled.

If the local agent does not succeed in unregistering the selected person from the target system, the reason for the error appears in the registration report.

Unregistration deletes the corresponding registration form from the SIB if it unregisters the last service.



4.3 HOW TO MODIFY A REGISTRATION

To modify a registration:

1. In the ISM-UM Registration Window, select the Edit Form button. The Modify Registration Form window is displayed.

2. This window is also a means of returning to a registration begun but not finished. For further information concerning this window, see the ISM-UM on-line help.

Figure 4-9. Modify Registration Form Window



4.3.1 What Data Can Be Modified

To access the modifiable fields:

• Select the User Account Parameters button. For further information, see the GCOS 7 User Account Parameters window.

• You can modify the user code by applying the following rules:

- a current user cannot become a security administrator if the responsible field is filled in.

- it is only possible to change the code for delegate administrators and current users.

• Select the Login and Password Parameters button. For further information see GCOS 7 Login and Password Parameters Window.

• Select the Service Access Parameters button. For further information, see Service Access Parameters window.

Validation of the modification causes updating of the corresponding data in the catalog and security base of the GCOS 7 system concerned.

NOTE: In the main window, the password can be modified.

4.3.2 How to Delete a Data Element

If you want to delete a data item, it must be modifiable and optional. All you have to do is fill in the corresponding field with spaces.



4.4 HOW TO SYNCHRONIZE REGISTRATIONS

The data associated with one or more users may be present in the SIB without being present on the target system, and vice versa. This data may not match.

The administration facility of ISM-UM includes import/export functions enabling synchronization of the data on the two systems.

4.4.1 Which Data to Synchronize

Data synchronization may involve:

a person the synchronization compares the person's attributes in the SIB of the ISM-UM machine and on the GCOS 7 system (SA 7 record).

a service the synchronization compares registrations of persons for the

services on the ISM-UM machine and on the GCOS 7 system (SA 7 record).

a system the synchronization compares the SIB and the SA 7 base for

all the system's services and all the records.



To perform these synchronizations:

1. For a person or project, select the object to be synchronized in the ISM-UM Registrations window.

For a system, select the object in the Resources window.

2. Select File/Synchronize Registration. The ISM-UM Synchronization Report window

is displayed.

Figure 4-10. Synchronization Report Window

If all the elements in the SIB and the SA 7 base are identical, this window will contain empty fields.

If there are differences, they are displayed in this window with a description of the attribute which is different.

3. From this synchronization report, import or export the characteristics of a record.

4.4.2 How to Import Data

From the Synchronization Report window, to import data:

1. Select the registrations that you want to import from the target system into the SIB.

2. In the menu bar, select Edit/Import from the system. The update is initialized. If the person does not exist in the SIB, ISM-UM indicates this.



4.4.3 How to Export Data

From the Synchronization Report window, to export data:

1. Select the registrations that you wish to export into the target system.

2. In the menu bar, select Edit/Export to the system. The update of the target is initialized.

47 A2 07UC Rev00 A-1

A. SECUR'ACCESS Audit Status

The table below gives details of the SA7-ISM-UM statuses and the corresponding errors.

Table A-1. SECUR'ACCESS Audit Status for SA7-ISM-UM (1/2)

SA7 Status

Anomaly

7 No data received Administrator's name not given This administrator does not exist in the base This administrator is not known in the GCOS 7 catalog This administrator is not a SECUR'ACCESS security administrator This administrator is black-listed This administrator is no longer active (expiry date exceeded)

107 108 109 110

Administrator password not given The administrator's password is incorrect The MIs are not valid The administrator has given an incorrect password

115 116

Project name not given The project specified does not exist in the catalog

121 122 123 124 125

The user identification is mandatory There is a syntax error in the user name The user specified does not exist in the base The user specified does not exist in the catalog The user specified is in the "awaiting signature" file

126 127

The user password is mandatory The user password is incorrect

128 129 130

The user project is mandatory The user project does not exist in the base The user-project link does not exist in the catalog

131 132

The default concept for the project is mandatory The value for the default project option is incorrect

134 135 136 137

The "black-list" indication is mandatory The "black-list" indication is incorrect The requested action concerning the black-list is impossible for this user Black-listing impossible: there must be at least 2 active administrators

138 139

The user code is mandatory The user code specified is incorrect

142 The language code specified is unknown


A-2 47 A2 07UC Rev00

Table A-1. SECUR'ACCESS Audit Status for SA7-ISM-UM (2/2)

SA7 Status

Anomaly

143 144

The card mask specified is unknown The serial number is mandatory if a mask is specified

145 146 147

Format of expiry date incorrect The expiry date must be later than today's date The expiry date must not be given

148 149 150

The serial number of the card must be numeric The card mask must be given if the serial number is specified The card identified by this serial number is already assigned to another user

151 152

The right must be numeric There must not be any duplicate rights

153 154 149

The cycle for the PIN must be numeric The cycle specified for the PIN does not exist in the SECUR'ACCESS base The card mask must be specified if the cycle is specified for the PIN

155 156

The cycle for the secondary password must be numeric The cycle specified for the secondary password does not exist in the SECUR'ACCESS base

157 158 159

The responsible person indicated does not exist in the SECUR'ACCESS base The responsible person indicated is not a delegate administrator The responsible person must not be specified for this user

160 161 162

The substitute can only be indicated for a delegate administrator The substitute does not exist in the SECUR'ACCESS base The substitute specified is not a delegate administrator

163 164 165 166 170 171 172 173 174 175 176 177 178 179 180

User code change prohibited: the user is a substitute delegate User code change prohibited: the user is a delegate responsible User code change prohibited. The project specified for the user is not authorized for the delegate responsible Internal GCOS 7 catalog access error Access to GCOS 7 catalog prohibited Integrity error on GCOS 7 catalog access attempt The project-user link already exists The project does not exist The password is incorrect The user is not known in the catalog The project-user link is not known in the catalog The "list" file is empty Billing error Other serious catalog access error

185 186

Integrity error on a record in the SECUR'ACCESS base SECUR'ACCESS base access error (IDS II problem)

190 191

Integrity error on a SECUR'ACCESS subprogram call Serious SECUR'ACCESS program execution error

47 A2 07UC Rev00 g-1

Glossary

ACCESS MASTER

ISM component that performs the authentication of the users of protected workstations.

Administration Role (IAM)

Object managed by ISM-UM. The role is characterized by its type (list of actions possible on certain types of object), the domain to which it applies (subtree of the model) and the list of persons carrying out this role.

ALEA

Random number (64 bits) supplied in input for certificate calculation. By extension, for SECUR'ACCESS, it is the 4-digit number which appears in the control or signature screen forms to complete the 4 digits of the Personal Identification Number.

API

Application Programmatic Interface

AUTHENTICATOR

Autonomous smart-card reader equipped with a keyboard and a display window that can be used to obtain from the card its serial number and certificates. It is a certifier modified for SECUR'ACCESS to use M6 cards.

BM

Bull MICRAL: a microcomputer running MS-DOS.

CAD1004

Authenticator loadable by PROCARD to handle M4 and M6 cards.


g-2 47 A2 07UC Rev00

CAM

Communication Access Method. Interface for communication between tasks on the DPS 7.

DATANET

Front-end processor or communications concentrator in a Bull network.

DCE

Distributed Computing Environment.

DNS

Data Network System. The system software of the DATANET.

DOMAIN

Organization within which the same security rules apply.

ESC

ESCAPE key on a terminal.

FORMS

Multiterminal presentation interface software enabling applications to work with a virtual terminal.

GCOS 7

Operating system of the DPS 7000.

GX-RPC

GCOS 7-UNIX Remote Procedure Call

IOF

Interactive Operation Facility. GCOS 7 open system enabling time-shared access by several users to the resources offered on the DPS 7000 with the necessary tools.

Glossary

47 A2 07UC Rev00 g-3

ISM

Integrated System Management

ISM-UM

Integrated User Management

JCL

Job Control Language. Language for writing command files to execute tasks under GCOS 7.

LECAM

Smart-card reader that can be connected to a MINITEL terminal.

LOGON

Program executed when a user connects (under TDS). Name also given to the connection phase itself.

MASK

Program type of a smart card. By extension, it also defines the type of card.

MCS

Control and security module. Installed in the PSG, this module contains the security elements for computing the checks of the certificates obtained from the users' smart cards.

MI

Marketing Identifier. Commercial unit identifying part or all of a software product.

MINITEL

Mass-market videotex terminal distributed by FRANCE TELECOM. Some models can also work in 80-column asynchronous mode.

SERIAL NUMBER

Identifier of a smart card. This identifier is unique and is stored in the card itself.


g-4 47 A2 07UC Rev00

OPEN 7

GCOS 7 subsystem that opens GCOS 7 up to a UNIX environment, particularly TCP/IP.

Operational Profile (IAM)

Set of privileges, general attributes and time ranges transmitted by the security server to the workstation after successful authentication. The operational profile also contains the unique authentication directory.

PIN

Personal Identifier Number. Confidential authentication element made up of a series of numeric characters, entered by the user and which authenticates the user in relation to his/her card.

PROCARD

Smart card specialized in loading the CAD1004. It contains the program for managing the reader for M4 or M6 cards for SECUR'ACCESS. The program is identified by an application number and a version number.

PROJECT

For the GCOS 7 catalog, the project is a set of users able to access a set of applications. Each user is known under the name of at least one project.

Profile (IAM)

Set of attributes of a person or alias. The profile contains a reference to a user role.

RPC-DCE

Protocol used by the client IUM-SA7 to dialog with GCOS 7.

SECADMIN

Name of the ISM-UM administrator.

SIB

Security Information Base of ISM-UM.

Glossary

47 A2 07UC Rev00 g-5

SOCKET

Virtual communication point that operates as a programmatic interface for TPC-UDP/IP. In practice, a socket is used as a file descriptor for input-output operations.

SPOM

Self Programmable On-chip Microprocessor. Identifies the type of microprocessor installed on a smart card.

STELLA 7

This is a set of products coupling a GCOS 7 system and a Bull UNIX system that can be used in a centralized enterprise production environment.

SYSADMIN

Project in the GCOS 7 catalog grouping users involved in managing the GCOS 7 system.

TCP/IP

Transmission Control Protocol over Internal network Protocol

TDS

Transactional Distributed System.

UDP/IP

User Datagram Protocol over Internal network Protocol

User Role (IAM)

When a person has several functions, ISM-UM assigns him/her several aliases and therefore several profiles, each pointing to a user role. The user role is a standard set of security attributes shared by the persons fulfilling this role. In a session, a user enjoys the privileges of one of his/her roles only. The role can be chosen in three ways: role determined by the connection workgroup, by an administrative action or by the user's choice at the start of the session.

WINDOW

Rectangle whose edges are parallel to the edges of the screen. It determines a space superimposed on the existing screen in which it is possible to establish a dialog. If this window disappears, the user recovers the full screen.


g-6 47 A2 07UC Rev00

47 A2 07UC Rev00 i-1

Index

A

Administrator role display 2-2 modify 2-2

C

Create service 3-8

D

Data exporting 4-16 importing 4-15

Declare system 3-5

Define systems 3-5

Display administrator role 2-2

E

Export data 4-16

F

Fill in registration form 4-1

I

Import data 4-15

Initialize registration 4-2

M

Modify administrator role 2-2 registration 4-12

P

Perform registration 4-1

R

Register 4-1 initialization 4-2 modification 4-12 resumption 4-10 synchronization 4-14

Registration unregistration 4-11

Resume registration 4-10


i-2 47 A2 07UC Rev00

S

Service creation 3-8

Synchronize registration 4-14

System declaration 3-5

Systems definition 3-5

U

Unregister registration 4-11

Technical publication remarks form

Title : DPS700/XTA NOVASCALE 7000 Secur'Access ISM\-UM Administrator's Guide

Reference Nº : 47A2 07UC 00 Date: January 1997

ERRORS IN PUBLICATION

SUGGESTIONS FOR IMPROVEMENT TO PUBLICATION

Your comments will be promptly investigated by qualified technical personnel and action will be taken as required.If you require a written reply, please include your complete mailing address below.

NAME : Date :

COMPANY :

ADDRESS :

Please give this technical publication remarks form to your BULL representative or mail to:

Bull - Documentation Dept.

1 Rue de ProvenceBP 20838432 ECHIROLLES [email protected]

Technical publications ordering form

To order additional publications, please fill in a copy of this form and send it via mail to:

BULL CEDOC357 AVENUE PATTONB.P.2084549008 ANGERS CEDEX 01FRANCE

Phone: +33 (0) 2 41 73 72 66FAX: +33 (0) 2 41 73 70 66E-Mail: [email protected]

CEDOC Reference # Designation Qty

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

_ _ _ _ _ _ _ _ _ [ _ _ ]

[ _ _ ] : The latest revision will be provided if no revision number is given.

NAME: Date:

COMPANY:

ADDRESS:

PHONE: FAX:

E-MAIL:

For Bull Subsidiaries:

Identification:

For Bull Affiliated Customers:

Customer Code:

For Bull Internal Customers:

Budgetary Section:

For Others: Please ask your Bull representative.

BULL CEDOC

357 AVENUE PATTON

B.P.20845

49008 ANGERS CEDEX 01

FRANCE

47A2 07UC 00REFERENCE