AT-TLS policy

A TTLS policy describes the desired AT-TLS rules. A TTLS policy allows for a wide range of filters to specify when a rule applies. As defined in the Policy Agent configuration file, the TTLS policy is located in /etc/pagent.ttls.conf. The necessary definitions in your security software are covered later.

For more information about TTLS policy keywords, see publication z/OS Communications Server: IP Configuration Reference (SC27-3651).

The following sample rule can be used to encrypt communication with a client. Here, Debug Profile Service is a server that listens on port 8143 for incoming connections from clients. This information is captured in the rule_HADRxxx_EQAPROF_server section.

Since encrypted communication requires the usage of a server certificate, we specify that the Policy Manager must use the certificates on the EQAPROF.keyring key ring, which is owned by the Debug Profile Service server user ID STCEQA. The Policy Manager will use the EQAPROF.cert certificate to identify Debug Profile Service to the client, and restricts which protocols and ciphers can be used. This information is captured in the env_HADRxxx_EQAPROF_server section.

Note: Protocol and cipher selection might impose restrictions and additional setup. For example, the usage of Elliptic Curve ciphers requires that z/OS ICSF (Integrated Cryptographic Service Facility) is available. For more information, see publication z/OS Communications Server: IP Configuration Reference (SC27-3651).

The grp_Production section holds definitions that can be shared across multiple rules.

##
## TCP/IP Policy Agent AT-TLS configuration information.
##
##-----------------------------
TTLSRule                      rule_HADRxxx_EQAPROF_server
{
 LocalPortRange           8143
 Direction                Inbound
 TTLSGroupActionRef       grp_Production
 TTLSEnvironmentActionRef env_HADRxxx_EQAPROF_server
}
##-----------------------------
TTLSEnvironmentAction         env_HADRxxx_EQAPROF_server
{
 HandshakeRole Server
 TTLSKeyRingParms
 {
  Keyring EQAPROF.keyring   # keyring must be owned by started task ID
 }
 TTLSEnvironmentAdvancedParms 
 { 
  CertificateLabel EQAPROF.cert 
  TLSV1.3 On 
  TLSV1.2 On 
  TLSV1.1 Off 
  TLSV1   Off
 } 
 TTLSCipherParms 
 { 
  V3CipherSuites4Char C02FC030130113021303
 }
}
##-----------------------------
TTLSGroupAction               grp_Production
{
 TTLSEnabled              On
 Trace                    3     # Log Errors to syslogd & IP joblog
#Trace                    254   # Log everything to syslogd
}

For more complex policies, you should use the IBM Configuration Assistant for z/OS Communications Server. This is a GUI-based tool that provides a guided interface for configuring TCP/IP policy-based networking functions and is available as a task in IBM z/OS Management Facility (z/OSMF), and as a stand-alone workstation application.