Securing CCI connections between AutoSys and Mainframe

Products

• Autosys Workload Automation

Issue/Introduction

This article provides instructions for securing the Common Communications Interface (CCI) connections between a distributed AutoSys environment (Linux/Unix) and a Mainframe environment.
This is typically required to satisfy security vulnerability scans on Port 1721.

Environment

• Product: AutoSys Workload Automation
• Component: CCI (Common Communications Interface)
• Platform: Linux / Unix and z/OS Mainframe

Cause

Standard CCI configurations may transmit the initial connection handshake in plain text or use default ports (1721) that trigger security vulnerability alerts.

Resolution

 To secure the outbound connection from AutoSys to the Mainframe, follow these steps:

1. Configure Outbound Security:

   • Edit the ccirmtd.prf file on the AutoSys host.
   • Add SECURE=YES to the REMOTE configuration lines for each mainframe node.
   • Example: REMOTE = mainframe_host node_name 32768 startup port=2505 retry=-1 SECURE=YES

2. Configure Inbound Security (Environment Variable):

   • Note: Do not add SECURE=YES to the LOCAL line in ccirmtd.prf. Doing so results in error CAICCI_E_2101 Profile error LOCAL defined incorrectly and causes the daemon to crash.
   • Define the system environment variable: CAI_CCI_SECURE=YES
   • Restart the CCI remote service (ccirmtd).
   • Once enabled, the node accepts only secure connections from peers using matching SSL certificates.

3. Verify Secure Connectivity:

   • Check the mainframe logs for message CAS9850I - CCI/SSL Active.
   • Verify active sessions show TLSv1.2 with robust ciphers (e.g., 256-bit AES_CBC).