StorageTek Enterprise Library Software

Security Guide

E36422-02

January 2014

StorageTek Enterprise Library Software Security Guide

E36422-02

Copyright © 2012, 2014, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

Preface

- Audience

- Documentation Accessibility

1 Overview

- Product Overview

- General Security Principles

- Keep Software Up To Date

- Restrict Network Access

- Keep Up To Date on Latest Security Information

2 Secure Installation

- Installing NCS/ELS

- Post-Installation Configuration

3 Securing ELS with AT-TLS – z/OS Only

4 Security Considerations for Developers

A Secure Deployment Checklist

B References

Preface

This document describes the security features of Oracle's StorageTek Enterprise Library Software (ELS).

Audience

This guide is intended for anyone involved with using security features and secure installation and configuration of StorageTek Enterprise Library Software (ELS).

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 Overview

This section gives an overview of ELS software suite and explains the general principles of application security.

Product Overview

ELS provides tape automation support for Oracle StorageTek mainframe tape environments for the following platforms:

- IBM z/OS platform. ELS supports a TCP/IP client/server tape automation architecture allowing the SMC client software running on one z/OS LPAR to communicate with the HSC/VTCS server software running on a different z/OS LPAR.

- The Fujitsu MSP/EX platform. SMC must execute on every host where tape processing occurs. The ELS server component (HSC/VTCS) may execute on the same MSP/EX host as the SMC, or may execute on a separate, remote host. When SMC and HSC/VTCS reside on different MSP/EX hosts, TCP/IP is used to send requests from the client host to the server host. To receive HTTP requests from a remote SMC client, the HTTP component must be activated on the SMC executing on the server host.

ELS client/server communication is used to issue control path requests, primarily mount/dismount requests, for virtual and physical tape volumes. Information contained in these control path requests consists of TapePlex configuration and policy information, virtual/physical tape transport unit addresses and virtual/physical tape volume serial numbers. Most important, ELS client/server communication never contains any customer data, which always travels over IBM FICON/ESCON data path interfaces connecting host LPARs to Oracle StorageTek tape transports or VSM virtual tape devices.

The information in this Security Guide applies to all ELS releases. As discussed in Part 3 of this guide, it is possible to secure ELS client/server control path communications when such protection is desirable or is required. Additionally, this document discusses security aspects of various ELS installation and post-installation activities.

General Security Principles

The following principles are fundamental to using any product securely.

Keep Software Up To Date

One of the principles of good security practice is to keep all software versions and patches up to date. The latest ELS cumulative maintenance bundle, along with individual PTFs and HOLDDATA, are all available on My Oracle Support (MOS). Cumulative maintenance bundles are updated monthly to include all PTFs from the latest ELS monthly regression test cycle. All the PTFs in a cumulative bundle have been tested together as a complete package. HIPER PTF Email notification is available by subscribing to MOS Hot Topics Alert documents for the ELS products. Customers are encouraged to stay on current maintenance levels, keep HOLDDATA up-to-date and subscribe to Hot Topics Alerts for HIPER notifications.

Restrict Network Access

For performance and security, route ELS control path communications over an isolated network behind a firewall. Using a firewall provides assurance that access to ELS systems is limited to a known network, which can be monitored and restricted if necessary. Using a dedicated network for ELS client/server communications eliminates network contention with other applications and improves tape system performance.

Keep Up To Date on Latest Security Information

Oracle continually improves its software and documentation. Check for revisions to this Security Guide and all other ELS product documentation on a regular basis. All of the ELS documentation referenced in this document is available on the Oracle Technical Network in the Tape Storage Products section.

2 Secure Installation

The IBM z/OS System Authorization Facility (SAF) provides essential protection for most security aspects of ELS. SAF is typically implemented with the IBM RACF package or equivalent. This section outlines using a RACF-based SAF environment to install and configure a secure ELS installation.

Installing NCS/ELS

The Oracle document StorageTek Enterprise Library Software: Installing ELS describes how to install and configure your version of ELS using RACF protection. Refer to this document for more information on following security-related installation topics:

- Installing the base software and the latest cumulative maintenance bundle

- ELS load library APF authorization

- HSC user exit library APF authorization

- SMC JES3 load library APF authorization

Post-Installation Configuration

These Oracle documents describe post-installation configuration tasks for your version of ELS:

- StorageTek Enterprise Library Software: Configuring HSC and VTCS

- StorageTek Enterprise Library Software: Configuring and Managing SMC

- StorageTek Enterprise Library Software: ELS Programming Reference

Refer to these documents for more information on the following security-related post-installation topics:

- Defining RACF protection for CDS data set security

- Defining command authority and programmatic interface authority using HSC user exit SLSUX15

- Defining volume access authority for mounting and ejecting volumes using HSC user exit SLSUX14

- Defining MVC pool and scratch subpool volser authority

- Defining an SMC OMVS RACF segment for communication with a remote HSC subsystem

- Defining an SMC OMVS RACF segment for communication with a VLE appliance

3 Securing ELS with AT-TLS – z/OS Only

The IBM z/OS Application Transparent Transport Layer Security (AT-TLS) facility uses SSL data encryption to secure z/OS TCP/IP applications. For more information on AT-TLS, refer to the IBM publication z/OS Communications Server: IP Configuration Guide, and see information on the AT-TLS Policy Agent information in the IBM publication z/OS Communications Server: IP Configuration Reference.

Securing ELS client/server communications between SMC and HSC/VTCS is described in the Oracle white paper Using AT-TLS with HSC/SMC Client/Server z/OS Solution: Implementation Example. This white paper is published on the Oracle Technical Network in the Tape Storage Products section. Refer to this publication for detailed configuration information.

To secure ELS with AT-TLS, Oracle recommends using any of these SSL cryptographic algorithms:

- SHA-2 family (SHA-256, SHA-384, SHA-512)

- AES >= 128-bit

- RSA >= 2048-bit

- Diffie-Hellman (DH) >= 2048-bit

- ECC >= 256-bit

Any other SSL cryptographic algorithms provide weaker protection and should not be used with ELS.

Note:
The StorageTek Virtual Library Extension (VLE) appliance for VSM does not currently support AT-TLS communications. Do not secure ELS VLE communications with AT-TLS.

4 Security Considerations for Developers

The Oracle document StorageTek Enterprise Library Software: ELS Programming Reference describes ELS APIs available to application developers. Programmatic interface to ELS uses the Unified User Interface (UUI), which uses the HSC command security exit SLSUX15 to manage access to its functions based on RACF authorization (or equivalent). See "Post-Installation Configuration", for more information on securing SLSUX15 with RACF.

A Secure Deployment Checklist

1. Use RACF protection (or equivalent) as discussed in this Security Guide.

2. Restrict network access. ELS and the tape libraries it manages should be behind the corporate firewall.

3. Secure ELS network traffic with the IBM AT-TLS facility if required.

4. Apply all ELS PTFs and HOLDDATA.

5. Contact Oracle software support at http://www.myoraclesupport.com/ if you encounter vulnerability in Oracle ELS software.

B References

The ELS documentation is saved in libraries organized by ELS release. Access this from Tape Storage Documentation page.

http://www.oracle.com/technetwork/documentation/tape-storage-curr-187744.html

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.