Download PDF - IBM Redbooks

More documents

Recommendations

Info

Example 8-24 shows the assigned values for these properties. Example 8-24 The javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword properties -Djavax.net.ssl.trustStore=/sapmnt/T73/global/SSL_client/sapssl.jks -Djavax.net.ssl.trustStorePassword=ssl2client Finally, get a certificate from the server, and use the Java keytool utility to import the certificate into a truststore. Example 8-25 shows how to use the keytool to import the RACF CA certificate into the keystore. Important: Complete this task before you switch the server-side SSL settings to take effect. Example 8-25 Creating a client key database and importing the CA certificate ./keytool -import -trustcacerts -alias sapdb2jcc -file DB0TDIST.CERT -keystore sapssl.jks Enter keystore password: ssl2client Owner: CN=DB0TDIST, OU=ISSW, O=IBM, L=POUGHKEEPSIE, ST=NEWYORK, C=US Issuer: CN=DB2RootCA, OU=ISSW, O=IBM, L=POUGHKEEPSIE, ST=NEWYORK, C=US Serial number: 1 Valid from: 7/27/11 12:00 AM until: 1/30/15 10:59 PM Certificate fingerprints: MD5: B3:5C:FB:86:08:E2:CA:62:1E:E8:07:60:0B:DC:A6:69 SHA1: D0:FD:9A:F9:E9:DE:62:AF:D8:1C:48:61:89:CA:CB:2B:98:5C:07:52 Trust this certificate? [no]: yes Certificate was added to keystore 8.5 Trusted security context and roles in DB2 10 DB2 10 includes enhancements to user ID authentication, which was introduced in DB2 9 for z/OS. These features are roles and trusted context. The following existing database objects are supported in DB2 10: ► Trusted security context ► Database roles ► Network trusted context ► Roles DB2 introduced the concept of trusted security context, so that you can limit the servers that are allowed to connect to DB2 to the set of SAP NetWeaver ASs. User IDs and password are only valid when used on these application servers. If a system is set up in this manner, a stolen user ID and password do not allow third parties to connect to DB2, unless they also log on to one of the authorized application servers. With the database roles feature, you can strictly control the activities of DBAs. For example, to accomplish a task, a role with the necessary privileges can be assigned to a DBA for an amount of time. After that time, the role is revoked. During this time interval, the activities of the DBA can be audited. This approach allows detection of situations in which a DBA explores sensitive data. 132 Running SAP Solutions with IBM DB2 10 for z/OS on the IBM zEnterprise System
Network trusted context is an object that gives users a specific set of privileges. It is available when the user connects to the database through a trusted connection. An example is in a web application environment. The application receives a trusted connection through the trusted context. Then users can have their identity passed to the database server. With this trusted context, you can then create a unique set of interactions between DB2 and your application. DB2 extends the trusted context concept to optionally assign a default role to a trusted context and optionally assign a role to a user of the context. A role is a database object that groups together one or more privileges. It can be assigned to users or objects, if objects are created in a trusted context, with the role defined as the owner, by specifying the ROLE AS OBJECT OWNER clause in the trusted context definition. Databases, table spaces, tables, indexes, and views can be implemented in a trusted context with a role as the owner of the created objects. A role is only available within a trusted context. You can define a role for a trusted context and assign it to authorization IDs. When associated with a role, and using the trusted connection, an authorization ID inherits all the privileges that the role grants. 8.5.1 Attributes of a trusted context A trusted context is an independent database entity that is based on a system authorization ID and connection trust attributes. The system authorization ID is a DB2 primary authorization ID that is used to establish the trusted connection. A SYSTEM AUTHID for a connection can be associated only with a single trusted context, ensuring that there is always a clear mapping between a specific connection and a specific trusted context. The connection trust attributes are ADDRESS, SERVAUTH, ENCRYPTION, and JOBNAME. They identify specific connections to consider as part of the trusted context. Any defined ADDRESS, SERVAUTH, or JOBNAME must also be unique in a trusted context. A trusted connection can be established for a local or a remote application. The attributes used to establish a trusted context are different for remote versus local applications. Additional information: For more information, see Securing DB2 and Implementing MLS on z/OS, SG24-6480. 8.5.2 How a trusted connection works A trusted connection is a database connection that is established when the incoming connection attributes match the attributes of a unique, enabled trusted context defined at the server. The trust attributes identify a set of characteristics about the specific connection that are required for the connection to be considered a trusted connection. The relationship between a connection and a trusted context is established when the connection to the server is first created and that relationship remains for the life of that connection. If a trusted context definition is altered, the changed attributes of the trusted context take effect when the next new connection request comes in, or when a switch user request is issued within an existing trusted connection. Chapter 8. Security enhancements of DB2 10 for SAP solutions 133
Page 1:
ibm.com/redbooks Front cover Runnin
Page 4 and 5:
Note: Before using this information
Page 6 and 7:
2.10.2 IBM zEnterprise BladeCenter
Page 8 and 9:
System software planning. . . . . .
Page 10 and 11:
Trademarks IBM, the IBM logo, and i
Page 12 and 13:
Maxim Kukarev is a Client Technical
Page 14 and 15:
xii Running SAP Solutions with IBM
Page 16 and 17:
1.1 IBM DB2 on System z and SAP The
Page 18 and 19:
technologies, it provides advanced
Page 20 and 21:
1.2.3 SAP Industry Solutions SAP In
Page 22 and 23:
8 Running SAP Solutions with IBM DB
Page 24 and 25:
2.1 SAP NetWeaver composition 2.1.1
Page 26 and 27:
Consequently, the central instances
Page 28 and 29:
► Data layer. The database instan
Page 30 and 31:
Integration ESB / Connectors Figure
Page 32 and 33:
2.4 Rolling maintenance Within one
Page 34 and 35:
2.7 Database server Another compone
Page 36 and 37:
Metro Mirror Figure 2-7 Metro and M
Page 38 and 39:
2.10.4 zEnterprise Ensemble System
Page 40 and 41:
System p or System x AIX, Linux on
Page 42 and 43:
SAP mixed 3-tier structure The data
Page 44 and 45:
3.1 Features implicitly used by SAP
Page 46 and 47:
3.1.4 Scalability improvements for
Page 48 and 49:
Insert time per row in msec. 500,00
Page 50 and 51:
New tables are automatically create
Page 52 and 53:
3.3 SAP modifications to optimize t
Page 54 and 55:
The solution is the Hybrid DBSL, wh
Page 56 and 57:
Figure 3-5 New DBM1 display Enhance
Page 58 and 59:
- Accumulated wait time for global
Page 60 and 61:
The view shown in Figure 3-8 for th
Page 62 and 63:
3.4.1 IN-list in-memory tables DB2
Page 64 and 65:
With DB2 10, the new access type NR
Page 66 and 67:
2. Ensure that the user who is crea
Page 68 and 69:
4.1 Installing Linux on System z, S
Page 70 and 71:
Installing the server from DVD We i
Page 72 and 73:
Verifying the installation In the I
Page 74 and 75:
Registration: To access the SAP Ser
Page 76 and 77:
Figure 4-4 Support Package list Fig
Page 78 and 79:
lnxsu11:t73adm 64> telnet wtsc59oe
Page 80 and 81:
2. Configure the JCL head. From the
Page 82 and 83:
4.2.2 Considerations for migration
Page 84 and 85:
Figure 4-8 DB2_V10_CHECK report Imp
Page 86 and 87:
4.2.4 Considerations for data shari
Page 88 and 89:
You must make the following changes
Page 90 and 91:
lnxsu11 Figure 4-12 SAP system land
Page 92 and 93:
Product Vendor Type Version SAP Net
Page 94 and 95:
5.1 Functions of Unified Resource M
Page 96 and 97: 5.2 Simplifying management tasks in
Page 98 and 99: Figure 5-6 DBA Cockpit initial pane
Page 100 and 101: Figure 5-8 Global Times panel Tip:
Page 102 and 103: Figure 5-10 Buffer Pools The Buffer
Page 104 and 105: Table 5-1 highlights the tasks or a
Page 106 and 107: Tip: To enable the capture of syspl
Page 108 and 109: Figure 5-14 AIX monitoring data Fig
Page 110 and 111: ► DB2 Network Stats ABAP report (
Page 112 and 113: 3. Enter the perfkit command to sta
Page 114 and 115: You can also access monitoring data
Page 116 and 117: Example 5-3 Linux memory utilizatio
Page 118 and 119: In addition to user resource utiliz
Page 120 and 121: In a high availability system, ever
Page 122 and 123: 7.1 Classifications of virtualizati
Page 124 and 125: 7.2 Resources to the virtual machin
Page 126 and 127: 112 Running SAP Solutions with IBM
Page 128 and 129: 8.1 Separation of duties for databa
Page 130 and 131: authority is granted to an entire D
Page 132 and 133: malicious or careless unauthorized
Page 134 and 135: After starting each audit policy, D
Page 136 and 137: 8.3 Writing SQL to audit SAP tables
Page 138 and 139: Example 8-13 shows the audit record
Page 140 and 141: The client and server perform the f
Page 142 and 143: Digital certificates: Digital certi
Page 144 and 145: The following rule conditions are a
Page 148 and 149: 8.5.3 Reasons for establishing trus
Page 150 and 151: Example 8-31 shows the results of a
Page 152 and 153: From the central log of the SAP sys
Page 158 and 159: The SAP implementation process from
Page 160 and 161: Typical roles and tasks for system
Page 162 and 163: Key documentation From the IT and C
Page 164 and 165: Then you see a list of SAP Notes th
Page 166 and 167: SAP Notes The SAP Note system is us
Page 168 and 169: ► SAP on DB2 9 for z/OS: Implemen
Page 170 and 171: participate in the failover automat
Page 172 and 173: As a best practice, use the SAP as
Page 174 and 175: ��
Page 176 and 177: System software planning SAP on the
Page 178 and 179: Software product Part number Commen
Page 180 and 181: Capability Software product Part nu
Page 182 and 183: � Decide which installation optio
Page 184 and 185: c. Disable the IEFUSI exit in membe
Page 186 and 187: 3. Optional: Make the directories a
Page 188 and 189: Additional information: For more in
Page 190 and 191: 11.After finishing the DB2 subsyste
Page 192 and 193: ARC The archive log data sets. CI T
Page 194 and 195: DB2 members of the same data sharin
Page 196 and 197:
Figure B-4 illustrates how SAP uses
Page 198 and 199:
OvercommitRatio Virtual Memory vers
Page 200 and 201:
► Set the following z/VM SRM para
Page 202 and 203:
► Separate the SAP private networ
Page 204 and 205:
DB2 10 ZPARMS for SAP Important: Yo
Page 206 and 207:
- SMS constructs and ACS routines -
Page 208 and 209:
Downloading and extracting the web
Page 210 and 211:
PI Process Integration PIT point-in
Page 212 and 213:
SAP Notes Registration required: To
Page 214 and 215:
200 Running SAP Solutions with IBM
Page 216 and 217:
DSNACCOX usage 45 dual-log LG1 and
Page 218 and 219:
untime environment 13 software 162
Page 220 and 221:
206 Running SAP Solutions with IBM
Page 222:
Running SAP Solutions with IBM DB2
show all

Download PDF - IBM Redbooks

Create successful ePaper yourself

Delete template?

Save as template?