Securing access to DB2 by IP address with ACF2
Article ID: 202413
Updated On:
Products
Issue/Introduction
How can ACF2 be used to secure access to DB2 by IP address?
Resolution
The TCP/IP SERVAUTH Class can be used to secure access via the IPv6 or IPv4 address of the user. The TERMID on a RACROUTE REQUEST=VERIFY call will no longer be used as the source ID when an IPv6-based port of entry is trying to gain access to a system, resource or dataset. Instead, IBM has created a new SESSION type, IP, and a new port-of-entry (POE) class, SERVAUTH. The new SERVAUTH keyword on the VERIFY RACROUTE call specifies the address of the identifier of the server through which a user is trying to gain access to the system. The address points to a 1-byte length field followed by a 64-byte data area, which contains the name of a resource in the SERVAUTH class. This resource name is the network access security zone name that contains the IPv6 address of the user. Security zone mappings are defined in the NETACCESS parameter block in a TCP/IP profile.
For example:
Create an ACF2 X(SGP) group for SERVAUTH.
DE24 / IPGROUP LAST CHANGED BY USER002 ON 10/28/20-15:24
INCLUDE(SERVAUTH) SOURCE
Add Source group to logonid USER002:
USER002 USER002 TEST SERVAUTH
ACCESS ACC-CNT(3) ACC-DATE(10/29/20) ACC-SRCE(SERVAUTH)
ACC-TIME(10:21)
PASSWORD KERB-VIO(0) KERBCURV() PSWA1TOD(00/00/00-00:00
PSWA2TOD(00/00/00-00:00) PSWD-DAT(00/00/00) PSWD-INV(0)
PSWD-TOD(10/28/20-15:16) PSWD-VIO(0) PSWDCVIO(0)
PWP-DATE(00/00/00) PWP-VIO(0)
TSO DFT-PFX(USER002)
STATISTICS CRE-TOD(10/28/20-15:16) SEC-VIO(1)
UPD-TOD(10/29/20-10:21)
RESTRICTIONS PREFIX(USER002) SOURCE(IPGROUP)
Update TCP/IP Netaccess definitions in TCPIP Profile as follows:
; ----------------------------------------------------------------------
NETACCESS
10.xx.xx.xx/32 TSTSPC
10.xx.xx.xx/8 OTHER
ENDNETACCESS
; ----------------------------------------------------------------------
Setup SERVAUTH rule so that USER002 can only access system from TSTSPC. All other users can access from anywhere.
*RESOURCE RULE EZB STORED BY USER002 ON 10/28/20-15:22
$KEY(EZB) TYPE(SER)
NETACCESS.-.TSTSPC UID(USER002) SERVICE(READ) ALLOW
NETACCESS.- UID(USER002) SERVICE(READ) PREVENT
NETACCESS.- UID(*) SERVICE(READ) ALLOW
An ACF2 SECTRACE will show access to DB2 occurring from TSTSPC for userid USER002 is the only IP address that is allowed.
CAS21D0I JOBNAME: MC24DIST USERID: DB2STCID ASID: 0057
CAS21D1I PROGRAM: DSNVEUS3 RB CURR: DSNVEUS3 APF: YES SFR/RFR: 0/0:0
CAS21D3I SAFDEF: VERIFY INTERNAL MODE: GLOBAL
CAS2200I RACROUTE REQUEST=VERIFY,RELEASE=7760,SESSION=IP,
CAS2200I SERVAUTH='EZB.NETACCESS.XXXX.TCPIP.TSTSPC',STAT=ASIS,
CAS2200I SMC=YES,ACEE=,APPL='MC24DB2',ENVIR=CREATE,ENCRYPT=YES,
CAS2200I ERROROPT=ABEND,LOC=ANY,LOG=ASIS,MSGSP=0,NESTED=NO,
CAS2200I PASSCHK=YES,PASSWRD='*SUPPRESSED*',TOKNOUT=,
CAS2200I USERID='USER002',WORKA=
ACF2 SECTRACE showing accessing DB2 from another machine resulted in the 8/48.
CAS21D0I TRACEID: RON1 EVENT#: 00020512
CAS21D0I JOBNAME: MC24DIST USERID: DB2STCID ASID: 0057
CAS21D1I PROGRAM: DSNVEUS3 RB CURR: DSNVEUS3 APF: YES SFR/RFR: 8/48:0
CAS21D3I SAFDEF: VERIFY INTERNAL MODE: GLOBAL
CAS2200I RACROUTE REQUEST=VERIFY,RELEASE=7760,SESSION=IP,
CAS2200I SERVAUTH='EZB.NETACCESS.XXXX.TCPIP.OTHER',
CAS2200I STAT=ASIS,SMC=YES,ACEE=,APPL='MC24DB2',ENVIR=CREATE,
CAS2200I ENCRYPT=YES,ERROROPT=ABEND,LOC=ANY,LOG=ASIS,MSGSP=0,
CAS2200I NESTED=NO,PASSCHK=YES,PASSWRD='*SUPPRESSED*',TOKNOUT=,
CAS2200I USERID='USER002',WORKA=
Additional Information
For details see ACF2 documentation section: TCP/IP
For details on the TCPIP Profile NETACCESS statement see IBM documentation NETACCESS statement
Feedback
