Enhancing security

The following topics describe enhancements for security:

z/OS Encryption Readiness Technology (zERT)
z/OS Encryption Readiness Technology (zERT) aggregation
IBM® zERT Network Analyzer
TN3270E Telnet server Express Logon Feature support for Multi-Factor Authentication
AT-TLS currency with System SSL
IBM Health Checker for z/OS FTP ANONYMOUS JES
IBM Health Checker for z/OS MVRSHD RHOSTS DATA
IBM Health Checker for z/OS SNMP agent public community name
SMF 119 TCP connection termination record (subtype 2) enhanced to provide IP filter information
VTAM 3270 intrusion detection services

z/OS Encryption Readiness Technology (zERT)
z/OS Encryption Readiness Technology (zERT) is a new capability provided by the z/OS V2R3 Communications Server. With zERT, the TCP/IP stack acts as a focal point in collecting and reporting the cryptographic security attributes of IPv4 and IPv6 application traffic that is protected using the TLS/SSL, SSH and IPSec cryptographic network security protocols. The collected connection level data is written to SMF in new SMF 119 subtype 11 records for analysis. Additionally, a new real-time network management interface (NMI) service is provided for network management applications to retrieve zERT SMF records as they are generated.
z/OS Encryption Readiness Technology (zERT) aggregation
z/OS V2R3 Communications Server, introduced a new function called z/OS Encryption Readiness Technology (zERT). With zERT, the TCP/IP stack acts as a focal point in collecting and reporting the cryptographic security attributes of IPv4 and IPv6 application traffic that is protected using the TLS/SSL, SSH, and IPSec cryptographic network security protocols. The collected connection level data is written to SMF in SMF 119 subtype 11 records.
IBM zERT Network Analyzer
z/OS Management Facility (z/OSMF) V2R3 with APAR PH03137, provides a new plug-in named IBM zERT Network Analyzer. IBM zERT Network Analyzer is a web-based graphical user interface that z/OS network security administrators can use to analyze and report on data reported in zERT Summary records.
TN3270E Telnet server Express Logon Feature support for Multi-Factor Authentication
z/OS V2R3 Communications Server, with APAR PI85185, RACF APAR OA53002, and IBM MFA for z/OS APARs PI86470 and PI93341, extends the TN3270 Telnet server Express Logon Feature (ELF) to support IBM Multi-Factor Authentication (MFA) for z/OS. With this support, TN3270 clients can experience the same single sign-on behavior that is already offered by the PassTicket-based ELF, but now via an MFA token that is assigned by a SAF-compliant external security manager like IBM Security Server RACF. With the new EXPRESSLOGONMFA parameter in the TN3270E Telnet server profile, ELF attempts to authenticate clients by using their X.509 client certificate through MFA. If no MFA token is available for the user, the authentication fails by default. ELF can be configured to revert back to PassTicket authentication in certain cases where MFA authentication is unsuccessful.
AT-TLS currency with System SSL
z/OS V2R3 Communications Server enhances Application Transparent TLS (AT-TLS) to support the features provided by System SSL.
IBM Health Checker for z/OS FTP ANONYMOUS JES
z/OS® V2R3 Communications Server provides a new IBM® Health Checker for z/OS application health check to help determine whether your FTP server allows anonymous users to submit jobs. When ANONYMOUS is enabled, it is recommended that ANONYMOUSLEVEL be set to 3 and ANONYMOUSFILETYPEJES be set to FALSE. Otherwise, anonymous users can submit jobs to run on the system.
IBM Health Checker for z/OS MVRSHD RHOSTS DATA
z/OS V2R3 Communications Server provides a new IBM Health Checker for z/OS application health check to help determine whether your MVRSHD server is active and whether RSH clients are using RHOSTS.DATA datasets for authentication. The MVRSHD server supports the RSH and REXEC protocols which transfer user ID and password information in the clear. There is also the potential of weak authentication for RSH clients using RHOSTS.DATA datasets. This authentication method allows remote command execution without requiring the RSH client to supply a password.
IBM Health Checker for z/OS SNMP agent public community name
z/OS V2R3 Communications Server provides a new IBM Health Checker for z/OS application health check to help determine whether your SNMP agent is configured with a community name of public. Because the SNMP community name of public is a well-known name, it should not be used with community-based security due to security considerations.
SMF 119 TCP connection termination record (subtype 2) enhanced to provide IP filter information
z/OS V2R3 Communications Server provides IP filter information in the SMF 119 TCP connection termination record (subtype 2). The name of the IP filter rules associated with inbound and outbound traffic for a connection are included in a new section of the record, if IP filtering is being done for a connection.
VTAM 3270 intrusion detection services
z/OS V2R3 Communications Server enables 3270 data stream intrusion detection services (IDS) that detect and act on violations of the 3270 data stream protocol.

Parent topic: V2R3 new function summary