z/VM Security Update - z/VM - IBM

Brian W. Hugenbruch, CISSP 

z/VM Security Design and Development 

bwhugen@us.ibm.com 

z/VM Security Update 

with a focus on exploring RACF for z/VM Single System Images 

© 2013 IBM Corporation

Trademarks 

The following are trademarks of the International Business Machines Corporation in the United States, other countries, or both. 

Not all common law marks used by IBM are listed on this page. Failure of a mark to appear does not mean that IBM does not use the mark nor does it mean that the product is not 

actively marketed or is not significant within its relevant market. 

Those trademarks followed by ® are registered trademarks of IBM in the United States; all others are trademarks or common law marks of IBM in the United States. 

For a complete list of IBM Trademarks, see www.ibm.com/legal/copytrade.shtml: 

*, IBM Systems, IBM System z10®, IBM System Storage® , IBM System Storage DS®, IBM BladeCenter®, IBM System z®, IBM System p®, IBM System i®, 

IBM System x®, IBM IntelliStation®, IBM Power Architecture®, IBM SureOne®, IBM Power Systems, POWER®, POWER6®, POWER7®, POWER8®, Power ®, 

IBM z/OS®, IBM AIX®, IBM i, IBM z/VSE®, IBM z/VM ®, IBM i5/OS®, IBM zEnterprise®, Smarter Planet ,Storwize®, XIV® , PureSystems, PureFlex, 

PureApplication , IBM Flex System , Smarter Storage 

The following are trademarks or registered trademarks of other companies. 

Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. 

Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. 

Java and all Java-based trademarks are trademarks of Sun Microsystems, Inc. in the United States, other countries, or both. 

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. 

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel 

Corporation or its subsidiaries in the United States and other countries. 

UNIX is a registered trademark of The Open Group in the United States and other countries. 

Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. 

ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. 

IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency, which is now part of the Office of Government Commerce. 

* All other products may be trademarks or registered trademarks of their respective companies. 

Notes: 

Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput that any user will 

experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. 

Therefore, no assurance can be given that an individual user will achieve throughput improvements equivalent to the performance ratios stated here. 

IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply. 

All customer examples cited or described in this presentation are presented as illustrations of the manner in which some customers have used IBM products and the results they may have achieved. Actual 

environmental costs and performance characteristics will vary depending on individual customer configurations and conditions. 

This publication was produced in the United States. IBM may not offer the products, services or features discussed in this document in other countries, and the information may be subject to change without 

notice. Consult your local IBM business contact for information on the product or services available in your area. 

All statements regarding IBM's future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. 

Information about non-IBM products is obtained from the manufacturers of those products or their published announcements. IBM has not tested those products and cannot confirm the performance, 

compatibility, or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. 

Prices subject to change without notice. Contact your IBM representative or Business Partner for the most current pricing in your geography. 

22 


Disclaimer 

The information contained in this document has not been submitted to any formal IBM test and is 

distributed on an "AS IS" basis without any warranty either express or implied. The use of this information 

or the implementation of any of these techniques is a customer responsibility and depends on the 

customer's ability to evaluate and integrate them into the operational environment. While each item may 

have been reviewed by IBM for accuracy in a specific situation, there is no guarantee that the same or 

similar results will be obtained elsewhere. Customers attempting to adapt these techniques to their own 

environments do so at their own risk. 

In this document, any references made to an IBM licensed program are not intended to state or imply that 

only IBM's licensed program may be used; any functionally equivalent program may be used instead. 

Any performance data contained in this document was determined in a controlled environment and, 

therefore, the results which may be obtained in other operating environments may vary significantly. 

Users of this document should verify the applicable data for their specific environments. 

It is possible that this material may contain reference to, or information about, IBM products (machines 

and programs), programming, or services that are not announced in your country. Such references or 

information must not be construed to mean that IBM intends to announce such IBM products, 

programming or services in your country. 

3 


Agenda 

z/VM Security Certifications 

Security Updates for z/VM 6.2 and beyond 

RACF In a Single System Image (SSI) Cluster 

4 


z/VM Security Certifications 

5 


z/VM Security Certification Discussion 

Common Criteria certification: 

– z/VM 6.1 certified (BSI-DSZ-CC-0752) 

– Target: OSPP-LS at EAL 4+ 

Federal Information Protection Standards (FIPS) 

– z/VM 6.1 System SSL is FIPS 140-2 Validated: 

• http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401val2012.htm#1735 

• Requires PM43382 

z/VM 6.2 is “designed to conform to” the Common Criteria and to FIPS 140-2 

– Refer to z/VM 6.2 Secure Configuration Guide 

Help us understand your certification needs 

– Comments now, or contact offline. 

6 

TM: A Certification Mark of NIST, which does not imply product endorsement by NIST, 

the U.S. or Canadian Governments. 


z/VM Security Certification Discussion 

The Common Criteria evaluated configuration of z/VM 6.1 includes: 

– z/VM Control Program, TCPIP, Telnet, RACFVM (included in previous evaluations) 

– z/VM SSL Server *new* 

Evaluated to the Operating System Protection Profile (OSPP) 

– Extensions for Labeled Security (-LS) and Virtualization (-VIRT) 

– Replaces the expired CAPP and LSPP profiles. 

A particular configuration of these parts is required 

– See the z/VM 6.1 Secure Configuration Guide 

– Lists associated service to apply 

Security-related service can be applied without invalidating the configuration 

– EAL4 “+” – “Flaw Remediation” 

7 


FIPS 140-2 Support for z/VM 6.1 

- PM08418: Upgrade System SSL to z/OS R11 

- VM64805: Add needed functions to LE 

- VM64751: Upgrade Binder to z/OS R11 

- PM10616: System SSL enablement of FIPS 

- PM43382: System SSL Self-Defense 

Enablement of support: z/VM 6.1 can be configured to comply 

to Federal Information Protection Standard (FIPS) 140-2 

– Requisite cipher suites assure a level of cryptographic strength 

– Creation and validation of certificate database assures trust 

Changes to TCPIP, System SSL, the Binder, and the SSL Server are available for 

z/VM 6.1 

Pertains both to the certificate database and the SSL server virtual machine 

These changes are bundled in z/VM 6.2 

8 

TM: A Certification Mark of NIST, which does not imply product endorsement by NIST, 

the U.S. or Canadian Governments. 


Security Updates 

to z/VM 

9 


SSL Server Reliability and Scalability 

- PK97437: SSLADMIN, TCPRUN and Related Packaging Changes 

- PK97438: SSLSERV Module Updates 

- PK75662: TCPIP Module Updates 

Internet! Internet! 

SSLSERV, 

SSLSERV, 

a trusted 

SSLSERV, 

server a trusted 

SSLSERV, 

server 

SSL00001, 

a trusted 

server a trusted 

a pool of commonly 

server 

configured SSL 

virtual machines 

TCPIP, 

a trusted 

server 

LINUX01, 

a virtual 

machine 

TCPMAINT, 

where you do 

your TCPIP and SSL 

configuration. 

Highly privileged. 

GSKADMIN, 

where you do 

your certificate 

management. 

LOGONBY ONLY. 

System SSL 

v1.x* 

/etc/gskadm/Database.kdb 

z/VM 

CPACF 

• Allows for greater scalability and availability 

• Shipped as service for z/VM 5.4 and 6.1 

• http://www.vm.ibm.com/related/tcpip/tcsslspe.html 

10 


z/VM SSL Client Certificate Support 

- PM52716: Enable Client Certificate Authentication in z/VM SSL 

Expansion of SSL/TLS handshaking processes to include checking for a clientpresented 

certificate 

– Dynamic TN3270 Support only 

– Certificate presented by client must match against data in the z/VM certificate database 

– New INTERNALCLIENTPARMS parameter: CLIENTCERTCHECK 

– Required for the z/VM 6.1 Common Criteria configuration 

APAR available for z/VM 6.1 and z/VM 6.2 

– Will be included in the base of the next z/VM release 

11 


LDAP Support Updates 

Country==US 

Upgrade to z/OS 1.11 ITDS in z/VM 6.1 

– Support for password change logging 

• z/OS uses RACF certificate services 

• z/VM uses System SSL services 

– Password phrases can now be used in an ldap bind 

Organization==IBM 

City==Endicott 

Upgrade to z/OS 1.12 ITDS in z/VM 6.2 

– RACF resource change-logging through LDAP 

• user, group, and general resource profiles 

• an open, remote method of change notification using only LDAP interfaces 

• an LDAP client can read the LDAP change log, detect updates to RACF users, 

groups, group membership, and general resources, and then retrieve RACF entries. 

• LDAP server must be configured to enable the SDBM backend. 

– Expanded password management 

• Expiry warnings 

• Interactively set new passwords 

Subject==Brian W. Hugenbruch 

12 


Crypto Support Updates 

APAR VM64656: z/VM support for Crypto Express3 cards 

– On the z10: z/VM 5.3, z/VM 5.4 and z/VM 6.1 

– On the z196: z/VM 5.4 and z/VM 6.1 

– Accelerator mode (CEX3A) and Coprocessor mode (CEX3C) 

APAR VM64793: Protected Key CPACF for z/VM 5.4 and z/VM 6.1 

– On both z10 and z196 

– Protection of key material when using CPACF, instead of Clear Key operations 

• Key does not exist outside of physical hardware 

– Not to be confused with Secure Key (for the Crypto Express cards) 

– Designed to increase throughput 

z/VM 6.2: 

– QUERY CRYPTO output changes 

APAR VM65007: zEnterprise EC12 compatibility Support 

– Required support in z/VM for zEC12 

– Includes Crypto Express4S (CEX4S) support 

– For z/VM 5.4, z/VM 6.1 and z/VM 6.2 

13 


RACF Updates for z/VM 6.2 

Multiple Access Ports per Guest 

– Can now enable a guest with multiple unique 

access ports to the same VSWITCH 

– Associates NICs and VSWITCH ports 

(Switch not available on NICDEF) 

– Ports are associated with VLANs 

– Requires explicit CP enablement 

•CP SET VSWITCH PORTNUMBER 

•CP SET VSWITCH VLANID 

LINUX1 4F8 

access 

1 

VLAN 

140 

LINUX1 4FC 

access 

2 

VLAN 

197 

RACF Enablement is business-as-usual, 

authorizing by VLAN IDs instead of port numbers: 

3 OSA 

LINUX2 4F8 

trunk 

– RDEFINE VMLAN SYSTEM.SWITCH05 UACC(NONE) 

– PERMIT SYSTEM.SWITCH05 CLASS(VMLAN) ID(LINUX1 LINUX2) ACCESS(UPDATE) 

– RDEFINE VMLAN SYSTEM.SWITCH05.0140 UACC(NONE) 

– PERMIT SYSTEM.SWITCH05.0140 CLASS(VMLAN) ID(LINUX1 LINUX2) ACCESS(UPDATE) 

– RDEFINE VMLAN SYSTEM.SWITCH05.0197 UACC(NONE) 

– PERMIT SYSTEM.SWITCH05.0197 CLASS(VMLAN) ID(LINUX1 LINUX2) ACCESS(UPDATE) 

– ... 

14 



User Attribute: PROTECTED 

– Shields user access from being revoked due to logon failures, inactivity or unsuccessful 

access attempts … via any method that uses a supplied password (logon, FTP …) 

– Service machines are a good candidate for this attribute 

– Any machine without a password or passphrase is Protected by default 

– Specify “NOPASSWORD” and “NOPHRASE” on ADDUSER or ALTUSER: 

ALTUSER TCPIP10 NOPASSWORD NOPHRASE 

– To remove the Protected attribute from a user, add a password or passphrase: 

ALTUSER BWHUGEN PHRASE(‘Three measures of Gordons, one of 

vodka, half a measure of Kina Lillet’) 

– Protected users can still be revoked through REVOKE 

15 



Protecting Real Devices 

– Authorization checking based on the VMDEV class 

• Usual access levels (NONE READ UPDATE CONTROL) apply 

– Triggers when Connecting a real device to a virtual machine for exclusive use, or connecting a tape 

device to a virtual machine for shared use 

• DEDICATE statements in the User Directory 

• ATTACH command 

• GIVE command 

– Device “SYSASCII” used for HMC integrated ASCII console 

Define RDEV.(rdevno).sysname to VMDEV 

– PERMIT RDEV.0456.* CLASS(VMDEV) ID(BWHUGEN) ACCESS(UPDATE) 

– SETROPTS CLASSACT(VMDEV) 

Enable an appropriate event: 

– RALTER VMXEVENT EVENTS1 ADDMEM(RDEVCTRL/CTL) 

– SETEVENT REFRESH EVENTS1 

16 



General Updates: 

High Level Assembler no longer required for most common customizations 

– HCPRWAC, for example 

ALTER (MW) access for VMMDISK no longer conveys the ability to change the access list 

for the minidisk 

DBUnload requirement for T-Disk removed 

– Can use existing minidisk instead 

17 



RPIDIRCT updates: 

Create VMLAN profiles from NICDEF statements 

– Doesn’t cover Multiple Access Ports (no NICDEF support) 

Create VMDEV profiles from DEDICATE statements 

Recognize IDENTITY and SUBCONFIG definitions 

Passwords AUTOONLY, LBYONLY, and NOPASS cause user to be Protected 

Password NOLOG causes user to be revoked unless required for POSIX 

– POSIX users will be Protected 

18 



Enablement and Control of SECUSER and OBSERVER when Mandatory 

Access Controls (SECLABELs) are active 

– CONSOLE OBSERVER (read-only) 

– SET OBSERVER (read-only) 

– CONSOLE SECUSER (read-write) 

– SET SECUSER (read-write) 

– CP SEND.G (read-write) 

– CP SEND.C (write-only) 

SECLABEL rules for read- and write-access apply: 

– “No read up, no write down.” 

19 


Security Label Math 

Top Secret 

LABEL3 

Confidential 

LABEL1 

Public 

LABEL2 

LABEL4 

Web Application Database Testing 

Read-only: Subject must “dominate” object (equal or greater sensitivity, contains all 

pertinent categories) 

Write-only: Object’s security label must “dominate” the subject 

– There are no resources with W/O access 

– Only applies to user-to-user (CP MSG) 

Read-write: The user’s and the resource’s assigned categories and levels must be 

identical 

20 


RACF In A 

Single System Image Cluster 

21 


z/VM SSI Cluster 

Member 1 

Multiple CTCs for ISFC-based 

SSI communications 

Member 2 

Shared volumes 

Member 3 

Member 4 

Non-shared volumes 

Common LAN for guest IP communications 

(optionally, with shared SAN for guest FCP 

connections) 

22 


Security Settings in an SSI Cluster 

A userid has the same password on all systems (Single- or Multi-Configuration) 

A Single Configuration Virtual Machine can only log onto one member of the cluster 

– Error message just like logging onto a userid on the same system 

A Multi-Configuration Virtual Machine is a distinct construct on each system 

A userid’s privilege classes are the same on every system 

– A common source directory definition 

The cluster maintains a single security context for the entire system 

– And an ESM, as with stand-alone systems, extends these capabilities 

23 


RACF in a Single System Image Cluster 

When installed in an SSI, RACF creates a single security context for the cluster 

– Shared database and definitions 

– Handshaking of RACFVM instances 

– Cluster-aware auditing 

RACF for SSI is for the entire cluster, it’s not something you can enable one step at a time. 

RPIDIRCT has been updated to handle both single-configuration and multi-configuration 

virtual machines 

The virtual machines have been modified to operate both in and out of an SSI … 

24 


RACF Virtual Machines in an SSI cluster 

IBMUSER 



Member 1 

IDENT RACFVM 


Member 2 





Member 3 



connections) 

Member 4 

25 



Handshaking and Command Propagation 

Each RACF server in the SSI must provide the same consistent security context. 

Commands that create broader changes need to be propagated across the cluster 

– SETROPTS 

– RVARY 

– SETEVENT 

RACF will suppress “extra” messages and marshal output when executing “remotely.” 

Locking done to ensure RVARY submissions are handled sequentially 

RACF command sessions don't support command propagation so in an SSI the commands 

SETROPTS, RVARY, and SETEVENT will be rejected with message: 

–RPITMP0021E 'command-name' RACF COMMAND MUST BE ISSUED WITH RAC 

IN A SSI 

RAC command, ISPF panels, and R_Admin API (used by LDAP) are interfaces which 

support command propagation 

26 



Handshaking and Command propagation 

The propagated commands output from each RACF server on each system is bracketed by 

the lines: 

–OUTPUT FROM ON SYSTEM 

–END OF OUTPUT 

SETROPTS and RVARY commands will be propagated in non-SSI multi-server 

environments. 

Propagation of MAC cache purge 

Purge initiated by specific operands instead of any SETROPTS command: 

– RACLIST REFRESH of SECLABEL class 

– Activating or inactivating VMMAC class 

– LOGOPTIONS auditing of VMMAC class 

– Any MLS change 

– MLQUIET 

– MLACTIVE(WARNING) 

– SECLABELAUDIT 

27 


The RACF Database in an SSI 




Member 1 



Member 2 

RACdb 





Member 3 



connections) 

Member 4 

28 


The RACF Database in an SSI 

All RACF servers in SSI must share the same RACF database 

– Databases are shareable today 

– Maintain a single security context; no confusion in security policy 

RACF database in SSI must be fullpack minidisk, must support reserve/release 

and can't be an FBA device 

– Full-pack 3390s for both the primary (200) and backup (300) 

– RDEVICE statements for each in the System Configuration file 

– Minidisk caching is automatically turned off 

RDEVICE 200 TYPE DASD SHARED YES /* Default RACFVM db */ 

RDEVICE 300 TYPE DASD SHARED YES /* Backup RACFVM db */ 

Database synchronization 

– When a member joins, CP+RACF will ensure that the joining server has identical 

database datasets to those being used and active in the SSI 

– Automatic propagation of RVARY commands 

29 


Auditing RACFVM (The Basics) 


SEND RACFVM SMF SWITCH 

RACF Database and backup 300 

200 

RACFVM 

XAUTOLOG RACFSMF 

RACFSMF 

• RACFVM-owned SMF logs 

• Controlled by SMF CONTROL 

• When disk is full, RACFVM XAUTOLOGs 

RACFSMF for record storage 

• Process can also be triggered manually 

• Alternate disk (302) is then used as the 

security log 

• RACFSMF-owned private disks 

• When XAUTOLOGged, will copy data 

from the 301/302 disks 

•SMFPROF EXEC (profile) 

• Data is then erased from the 301 or 302 

301 

191 

302 

192 

ZVM540BH 

30 


Auditing RACF in a Single System Image cluster 


IDENT RACFSMF Multiple CTCs for ISFC-based IDENT RACFSMF 


Member 1 



Member 2 

200 


IDENT RACFSMF 



IDENT RACFSMF 

SYSADMIN 


Member 3 



connections) 

Member 4 

31 



RACFVM is a multiconfiguration virtual machine 

– Shared RACF database 

– All other disks are local – including 301 and 302 for auditing 

– Separate SMF CONTROL files operating against a single security context 

RACFSMF is also multiconfiguration virtual machine 

– Separate 191 and 192 disks 

– Separate SMFPROF EXEC files 

Auditing automation should account for this disparity to gather all pertinent audit 

records 

– Make sure all SMF CONTROL files are modified as appropriate 

– Make sure auditing policy and SMF records are managed accordingly 

32 



In the case of some commands – the AT command in particular – auditing records 

will appear on the destination system 

–AT_LOGON 

–AT_FROM 

–AT_LOGOFF 

Auditing distinguishes between local and remote nodes in a cluster, even when 

sharing the same security context 

– Controlled commands are the same 

– Auditing requisites are the same 

– Events are the same 

…. But the systems are distinct, from the point of view of a virtual machine “in 

the know” 

33 


RACF and Live Guest Relocation 




Member 1 



Member 2 

200 




SYSADMIN 


Member 3 



connections) 

Member 4 

34 


RACF and Live Guest Relocation 

Live Guest Relocation 

VMRELOCATE MOVE USER userid TO sysid 

– Class A command 

RACF cleans up a user’s presence on the source system, and prepares for the target 

system for the relocate-logon of the user 

Generate LOGOFF/LOGON auditing events on source/target system, to note the transition 

RACF perspective of relocate events: 

– User data is created for userid on sysid with all the above 

– User resources are allocated on sysid 

– Associated authorization calls are approved without a RACF check 

– Relocate-logon is requested for userid on sysid when the inbound relocation is complete 

35 


SSI and Virtual Security Zones 



IDENT RACFVM SSI communications IDENT RACFVM 

Member 1: 

Domains Yellow, Green 

Member 2: 

Domain Green 





Member 3: 

Domain Yellow 



connections) 

Member 4: 

Domain Blue 

36 


SSI and Virtual Security Zones 

LINUX01 

MVSUSR1 



MVSUSR2 

LINUX05 

Member 1 



Member 2 




LINUX02 

LINUX03 

LINUX04 


Member 3 



connections) 

Member 4 

37 


Migrating to RACF in an SSI 

You can have an ESM and still migrate to SSI! 

– Step 1: If you don’t have an ESM, get one. 

– Line up the shared DASD required for the database; remember that this needs to be a 

fullpack minidisk! 

– If you’re converting one or more ESM-controlled systems into an SSI: 

38 


Migrating to SSI: RACF Considerations 




SYSTEM1 



SYSTEM2 

RACdb 





connections) 

39 







– If you’re converting one ESM-controlled systems into an SSI: 

• Migrate to 6.2 in a non-SSI format 

• Convert associated resource profiles to 6.2 format, using RPIDIRCT as necessary 

• Take the steps to enable SSI; turn on RACFVM as part of the outlined process 

– If you’re converting two (or more) distinct ESM-controlled systems to an SSI 

40 


Migrating to SSI: RACF Considerations 




SYSTEM1 



SYSTEM2 

RACdb 


RACdb 




connections) 

RACdb 

41 







– If you’re converting one or more ESM-controlled systems into an SSI: 

• Migrate to 6.2 in a non-SSI format 

• Convert associated resource profiles to 6.2 format, using RPIDIRCT as necessary 

• Take the steps to enable SSI; turn on RACFVM as part of the outlined process 

– If you’re converting two (or more) distinct ESM-controlled systems to an SSI 

• You will need to merge the databases 

• You may want to consider which of your 2+ systems has the most complex security 

context before choosing which one is the “master” system 

• After one system is enabled, make directory and RACF database updates for the 

secondary system 

42 


Summary 

Certifications validate the high standard of z/VM security 

z/VM continues to deliver functional updates to keep pace with modern security 

requirements 

RACF has been adapted to handle the Single System Image clustering technology 

z/VM continues to secure the road to Smarter Computing 

43 


For more information … 

On the web: 

z/VM Security resources: http://www.VM.ibm.com/security 

z/VM Secure Configuration Guide: http://publibz.boulder.ibm.com/epubs/pdf/hcss0b30.pdf 

System z Security: http://www.ibm.com/systems/z/advantages/security/ 

Redbook: z/VM Security, SG24-7471 

• http://www.vm.ibm.com/related/tcpip/vmsslinf.html -- SSL Information and Walk-through 

Contact Information: 

Brian W. Hugenbruch, CISSP 

z/VM Security Design and Development 

bwhugen at us dot ibm dot com 

+1 607.429.3660 

44 


Dank u 

Dutch 

Merci 

French 

Спаcибо 

Russian 

Gracias 

Spanish 

شكراً‏ 

Arabic 

Obrigado 

Brazilian 

Portuguese 

Grazie 

Italian 

धयवाद 

Hindi 

Dankon 

Esperanto 

ありがとうございます 

Japanese 

go raibh maith agat 

Gaelic 

 

Tamil 

감사합니다 

Korean 

תודה רבה 

Hebrew 

Thank You 

Trugarez 

Breton 

děkuji 

Czech 

Danke 

German 

Tack så mycket 

Swedish 

Tak 

Danish 

 

Thai 

谢谢 

Chinese 

45

z/VM Security Update - z/VM - IBM

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?