File Transfer Protocol (FTP), built on client-server architecture, is a standard method for transferring files between hosts over a TCP-based network on different platforms as Unix, Z/OS, AS/400, Windows etc.
Mainframe FTP features
z/OS FTP uses get and put commands for downloading and uploading files.
In a Sysplex to share the system's workload, FTP can be simultaneously extended to multiple CPUs.
Mainframe FTP can transfer both MVS datasets and Unix files.
Risks associated with mainframe and FTP
Exposure of sensitive data like user ID and password, which might lead to unwanted access to the business critical information
No control over the data after it's transmitted
Access to the sensitive data in job output or printouts
Access to USS files as well as MVS datasets
Accessing Mainframe DB2 data
For the execution of programs submission of batch jobs
Available FTP security tools to address the risks
Control file options for FTP and TCP/IP
Security software rules like System Authorization Facility (SAF)
Exits for modifying the FTP logic
Encryption
Policy agent software like firewall
Functionalities of the tools
Controls the data access based on both mainframe server IP address and client computer IP address
Controls the data access based on port number. Each TCP program at an IP address is assigned with a separate port number. In general, ports 20 and 21 are used for FTP. Based on the port number in any message TCP decides to which program on that computer the received message should be sent. These ports are called Ephemeral Ports and the programs are called daemons. The daemon for FTP is named FTPD.
Uses System Authorization Facility (SAF) to invoke security software in mainframe. SAF helps to verify user identity and in turn file and resource access.
Controls Unix and MVS files access
Modifies FTP logic through Exit programs by adding additional security checks
Encrypts user ID, password and critical information
FTP security tools in detail
Control file options for TCP/IP and FTP
oIPSEC for IPSEC secure tunnel creation
oPORT and PORTRANGE for controlling access to specific ports
oNETACCESS for controlling access to specific IP addresses in a network
oTCPCONFIG for blocking particular ports to prevent unauthorized FTP programs
oDB2 and DB2PLAN to specify the DB2 subsystem and plan
oANONYMOUS to control anonymous logins
oCIPHERSUITE to specify encryption algorithm
oKEYRING to specify the keyring for digital certificates
oJES2INTERFACELEVEL for submitting batch jobs and accessing the print outputs
Security Software Rules
TCP/IP and FTP call the security software through SAF. The security software rules are defined into the resource classes such as APPL, TERMINAL and SERVAUTH. Resource Descriptor Table (RDT) contains the class names and different options.
oAPPL controls login to FTP daemon
oTERMINAL, used with IPV4, controls login from any specified IP address
oSERVAUTH controls access to Unix file system, specified IP addresses, ports and the network
Exits
oFTCHKIP controls a new connection
oFTCHKCMD controls the processing of an FTP command
oFTCHKJES controls the submission of a batch job
oFTCHKPWD controls the new passwords
oFTPOSTPR controls the completion of certain commands
Encryption
The Mainframe supported encryption protocols are Secure Sockets Layer (SSL), Transport Layer Security (TLS), IPSEC and Kerberos. All these protocols are used to encrypt data as well as passwords. They protect the files to be transmitted, against sniffer programs. SSL and TLS are used to create and manage digital certificates and encryption keys.
Policy Agent
Policy Agent is a mainframe software used to filter messages and for Intrusion detection services. For the filtration of messages IP address, port number and content play an important role.
Mainframe FTP features
z/OS FTP uses get and put commands for downloading and uploading files.
In a Sysplex to share the system's workload, FTP can be simultaneously extended to multiple CPUs.
Mainframe FTP can transfer both MVS datasets and Unix files.
Risks associated with mainframe and FTP
Exposure of sensitive data like user ID and password, which might lead to unwanted access to the business critical information
No control over the data after it's transmitted
Access to the sensitive data in job output or printouts
Access to USS files as well as MVS datasets
Accessing Mainframe DB2 data
For the execution of programs submission of batch jobs
Available FTP security tools to address the risks
Control file options for FTP and TCP/IP
Security software rules like System Authorization Facility (SAF)
Exits for modifying the FTP logic
Encryption
Policy agent software like firewall
Functionalities of the tools
Controls the data access based on both mainframe server IP address and client computer IP address
Controls the data access based on port number. Each TCP program at an IP address is assigned with a separate port number. In general, ports 20 and 21 are used for FTP. Based on the port number in any message TCP decides to which program on that computer the received message should be sent. These ports are called Ephemeral Ports and the programs are called daemons. The daemon for FTP is named FTPD.
Uses System Authorization Facility (SAF) to invoke security software in mainframe. SAF helps to verify user identity and in turn file and resource access.
Controls Unix and MVS files access
Modifies FTP logic through Exit programs by adding additional security checks
Encrypts user ID, password and critical information
FTP security tools in detail
Control file options for TCP/IP and FTP
oIPSEC for IPSEC secure tunnel creation
oPORT and PORTRANGE for controlling access to specific ports
oNETACCESS for controlling access to specific IP addresses in a network
oTCPCONFIG for blocking particular ports to prevent unauthorized FTP programs
oDB2 and DB2PLAN to specify the DB2 subsystem and plan
oANONYMOUS to control anonymous logins
oCIPHERSUITE to specify encryption algorithm
oKEYRING to specify the keyring for digital certificates
oJES2INTERFACELEVEL for submitting batch jobs and accessing the print outputs
Security Software Rules
TCP/IP and FTP call the security software through SAF. The security software rules are defined into the resource classes such as APPL, TERMINAL and SERVAUTH. Resource Descriptor Table (RDT) contains the class names and different options.
oAPPL controls login to FTP daemon
oTERMINAL, used with IPV4, controls login from any specified IP address
oSERVAUTH controls access to Unix file system, specified IP addresses, ports and the network
Exits
oFTCHKIP controls a new connection
oFTCHKCMD controls the processing of an FTP command
oFTCHKJES controls the submission of a batch job
oFTCHKPWD controls the new passwords
oFTPOSTPR controls the completion of certain commands
Encryption
The Mainframe supported encryption protocols are Secure Sockets Layer (SSL), Transport Layer Security (TLS), IPSEC and Kerberos. All these protocols are used to encrypt data as well as passwords. They protect the files to be transmitted, against sniffer programs. SSL and TLS are used to create and manage digital certificates and encryption keys.
Policy Agent
Policy Agent is a mainframe software used to filter messages and for Intrusion detection services. For the filtration of messages IP address, port number and content play an important role.
Source...