Administrator Services

This section covers the following topics:

• Access to Administrator Services

• General Options

• Authentication Options

• PF-Keys

• Logon/Countersign Errors

• Logon Records

• Maintenance Log Records

• SAF Online Services

• User Default Profiles

• Library Default Profiles

• Library and User Preset Values

• Definition of System Libraries

• Definition of Undefined Libraries

The Administrator Services subsystem provides several functions which apply to Natural Security as a whole and to all security profiles.

To invoke Administrator Services:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu will be displayed.

2. The Administrator Services Menu consists of two screens. With PF7 and PF8, you can switch between the two screens. They provide the following functions:

Administrator Services Menu 1:

• General Options (*)

• Authentication Options

• PF-Keys

• Logon/Countersigns Errors

• Logon Records

• Maintenance Log Records

• SAF Online Services

Administrator Services Menu 2:

• Environment Profiles

• User Default Profiles (*)

• Library Default Profiles (*)

• Library and User Preset Values

• Utility Defaults/Templates (*)

• Definition of System Libraries

• Definition of Undefined Libraries

• Application Programming Interfaces

You should study the functions marked above with (*) before you start defining objects to Natural Security. The other Administrator Services functions are not directly related to defining objects to Natural Security.

Access to Administrator Services

Access to the Administrator Services subsystem is controlled a) by the owner specifications in the security profile of the Natural Security library SYSSEC, and b) by the command processor NSCCMD01:

• If no owner are specified in the security profile of SYSSEC, every user of type "Administrator" may access the Administrator Services subsystem.

• If owners are specified in the security profile of SYSSEC, the field Functional Security Defined for the command processor NSCCMD01 in SYSSEC determines who may access the Administrator Services subsystem:

  • If this field is set to Yes (this is the default), only the owners of SYSSEC may access Administrator Services.

  • If this field is set to All, every user of type "Administrator" may access Administrator Services.

  In either case, the functional security specifications made in the library profile of SYSSEC and in the Administrators' user profiles determine which Administrator Services functions may be used.

For information on owners in library security profiles, see the sections Library Maintenance and Countersignatures. For information on the command processor NSCCMD01, see the section Functional Security for Library SYSSEC.

General Options

Before you start defining objects to Natural Security, it is advisable to specify a number of options which apply to the Natural Security system as a whole.

To invoke General Options:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select General Options.

   The Set General Options screen will be displayed.

3. The Set General Options screen consists of two screens. With PF7 and PF8 you can switch between the two screens. They provide the following options:

General Options - Screen 1:

• Transition Period Logon

• Activate Security for Development Server File

• Maximum Number of Logon Attempts

• Suppress Display of Logon Messages

• Lock User Option

• User Password History

• Free Access to Functions via APIs

• Minimum Number of Co-Owners

• Deletion of Non-Empty Libraries Allowed

• Overwriting of Defaults Possible

• Display DBID/FNR of FSEC

• Exit Functions with Confirmation

• Logging of Maintenance Functions

General Options - Screen 2:

• Store Logon and Error Data on Separate System Files

• Concurrent Modifications Without Notification

• Private Libraries in Public Mode

• Suppress Mailboxes in Batch Mode

• Environment Protection

• Access To Current FSEC

• Force Impersonation for Natural Development Server

• Record Each User's Initial Logon Daily

• Enable Error Transaction Before NAT1700/1701 Logoff

• Logoff in Error Case if *STARTUP is Active

• Set *APPLIC-NAME Always to Library Name

• Allow Deletion of Users Who Are Owners/DDM Modifiers

The individual options are described below.

Transition Period Logon

This option allows a smooth transition from an unprotected Natural environment to one protected by Natural Security.

The effects of the Transition Period Logon settings are illustrated below.

If you have had an unprotected Natural installation and now have installed Natural Security for the first time, it is advisable to set the Transition Period Logon to "Y" so as to ensure that work with Natural may continue while users and libraries are defined to Natural Security. Once all objects and links are defined, the Transition Period Logon should be set to "N".

Conditions of use under Transition Period Logon = Y:

Conditions of use under Transition Period Logon = N:

Activate Security for Development Server File

This option only appears if the Natural Development Server is installed and the current Natural session uses a development server file. It is only relevant if you wish to control the access to base and compound applications on the development server file. For details, see the section Protecting Natural Development Server Applications.

Maximum Number of Logon Attempts

Suppress Display of Logon Messages

This option may be used to suppress the display of the messages NAT0853 and NAT0854, which indicate that a logon to a library has been successful. By default, one of these messages is displayed after every successful logon to a library.

Lock User Option

This option may be used to prevent users from trying to misuse other users' user IDs and passwords. It applies to the logon procedure and to the countersignatures feature.

Natural RPC Service Calls

For logon attempts to libraries via Natural RPC service calls, this option only takes effect if the Lock user option in the Library And User Preset Values is set to "*". For Natural RPC service calls, the following applies:

• The settings "Y" and "F" have the same effect as "X".

• When locking occurs, the client user IDs which are locked will not include the ID as contained in the system variable *INIT-USER.

User Password History

This option corresponds to the option User password history set in the Library and User Preset Values.

Free Access to Functions via APIs

You may specify who may access Natural Security maintenance and retrieval functions from outside Natural Security via the application programming interfaces (APIs) provided. For details on these APIs, see the section Application Programming Interfaces.

Maintenance functions are all functions of the subprograms NSCFI, NSCLI, NSCOB and NSCUS - except their Display functions.

Retrieval functions are:

• all functions of the subprograms NSCCHCK, NSCDEF, NSCDU, and NSCXR and of the subprograms whose names begin with NSCDA,

• the Display functions of the subprograms NSCFI, NSCLI, NSCOB and NSCUS.

Minimum Number of Co-Owners

For an explanation of co-owners, see the section Countersignatures; leave the value set to "0" until you have read that section.

Deletion of Non-Empty Libraries Allowed

This option determines whether a library's security profile can be deleted if the library contains any source or object modules.

Overwriting of Defaults Possible

This option determines whether the values set on the Preset Library And User Values screen may be overwritten in individual security profiles.

The preset values are described under Library and User Preset Values below.

Display DBID/FNR of FSEC

This option determines whether the database ID and file number of the current Natural Security system file (FSEC) are to be displayed on the menu and selection screens within the library SYSSEC.

Exit Functions with Confirmation

This option determines how Natural Security reacts when you leave a function by pressing PF2, PF3, PF12 or PF15.

For details on the functions assigned to these keys, see the section PF-Keys.

Logging of Maintenance Functions

This option allows you to ascertain who has modified which security profiles and Administrator Services settings.

"Modify" in this context comprises all maintenance functions applied to a security profile (including Add, Copy, Delete, Link, etc.); it also includes the transfer of a security profile with the programs SECULD2 and SECLOAD.

When you set this option to "Y", a window will be displayed in which you can specify the following:

//CMSYNIN DD *
R,A
old-DBID,old-FNR,new-DBID,new-FNR

To change the above specifications once you have activated the writing of log records, you press PF4 on the Set General Options screen.

To view the log records, you use the function Maintenance Log Records (see below).

Store Logon and Error Data on Separate System Files

This option can be used to store some Natural Security data on separate system files.

Concurrent Modifications Without Notification

This option determines how Natural Security reacts in a situation in which two administrators simultaneously modify the same security profile. Such a situation would occur as follows:

1. Administrator 1 invokes a security profile for modification.

2. Administrator 2 invokes the same security profile for modification.

3. Administrator 1 leaves the function after having made his/her modifications - the modifications are applied to the security profile. This means that, at this point, Administrator 2 is working on data which are "out of date", but is not aware of this fact.

4. Administrator 2 leaves the function after having made his/her modifications. Now there are two possible reactions by Natural Security:

   • The modifications made by Administrator 2 are applied - unknowingly overwriting the modifications made by Administrator 1.

   • Administrator 2 receives a window, informing him/her that the security profile in question was in the meantime modified by another administrator. He/she can then contact the other administrator to discuss the changes made, and can then decide to either cancel his/her own modifications or apply them, thus overwriting the modifications made by Administrator 1.

This option determines which of these two reactions is to be taken; that is:

This option only applies to concurrent modifications made to security profiles of users, libraries, special links and mailboxes.

Private Libraries in Public Mode

This option determines whether private libraries are to be available in "private mode" or in "public mode".

See Private Library in the section User Maintenance for further information. Please read that section before you set this option.

Suppress Mailboxes in Batch Mode

This option determines whether or not mailboxes are output in batch mode.

For information on mailboxes, see the section Mailboxes.

Environment Protection

This option determines if Natural environments - that is, system-file combinations - are protected.

If you change the setting of this option, you have to restart your Natural session for the change to take effect.

For details on environment protection, see the section Protecting Environments.

Access To Current FSEC

This field determines whether the Natural Security data stored on this FSEC system file may be accessed from a Natural Security session running with another FSEC system file.

Force Impersonation for Natural Development Server

This option is only relevant for the Natural Development Server (NDV). It controls how access to an NDV server is handled.

It is assumed that access to the operating system on which an NDV server is running is controlled by an SAF-compliant external security system. User authentication (verification of user ID and password) is performed by this external security system. After a successful authentication, it generates an "accessor environment element" (ACEE) for the user, which is available for subsequent authorizations.

Record Each User's Initial Logon Daily

This option may be used to detect unused user IDs, that is, user security profiles which have not been used for a long time. This may be helpful when you decide to delete user security profiles which are no longer used.

When this option is set to "Y", you can use the application programming interface NSCXRUSE to obtain a list of users who have not logged on since a specified date.

Enable Error Transaction Before NAT1700/1701 Logoff

This option determines whether or not the current Natural application's relevant ON ERROR statement and/or error transaction will be processed in the event of Natural errors NAT1700 (time window exceeded) and NAT1701 (non-activity time limit exceeded).

The error transaction is determined by the value of Natural system variable *ERROR-TA.

This option only takes effect on mainframe computers. On non-mainframe platforms, Natural Security always reacts as if it had been set to "G" (regardless of the actual setting).

Logoff in Error Case if *STARTUP is Active

This option determines the course of action to be taken in the case of a Natural runtime error occurring within the ON ERROR condition of a startup transaction (*STARTUP).

When a runtime error occurs within the ON ERROR condition of a startup transaction, Natural's error processing might lead to the startup transaction being executed again. This would cause an error-loop situation. To prevent such a loop, you can set this option.

If no startup transaction is defined, this option has no effect.

Set *APPLIC-NAME Always to Library Name

This option determines the value of the Natural system variable *APPLIC-NAME.

Allow Deletion of Users Who Are Owners/DDM Modifiers

This option determines whether a user security profile can be deleted if the user is still specified either as owner in any security profile or as DDM modifier in any DDM/file security profile.

This option can only be set if owners are assigned to the Natural Security library SYSSEC.

If this option is set to "O" or "A" and the security profile of a user is deleted, his/her ID is automatically removed from any security profiles where he/she is specified as owner or DDM modifier. Nonetheless, it may be advisable before the deletion to use the Cross-Reference User function to ascertain which profiles/DDMs would be affected, and after the deletion to make sure the changed owner/co-owner and DDM modifier/co-modifier configurations still suit your requirements.

Authentication Options

This section describes the options available for the authentication type LDAP (Light Directory Authentication Protocol).

If user authentication via an LDAP server is to be used, this requires that the SSX security libraries were installed as part of the Natural Security installation procedure.

User authentication via an LDAP server (that is, a server which uses the Light Directory Authentication Protocol) is only possible on UNIX and Windows for online and batch sessions which are started with the Natural profile parameter AUTO=OFF. It is activated by setting the field Protection Level in the LDAP security profile to "1" (see below).

If an LDAP server is to be used, it has to be defined to Natural Security, that is, a security profile has to be defined for it, as described below.

• Creating and Maintaining the LDAP Security Profile

• Components of the LDAP Security Profile

Creating and Maintaining the LDAP Security Profile

To create/maintain the LDAP security profile:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select Authentication Options.

   The Authentication Types selection list will be displayed.

3. To create the LDAP security profile, you press PF4 or enter the direct command ADD on the selection list.

   The first screen of the LDAP security profile will be displayed. The items you can define in it are described below under Components of the LDAP Security Profile.

   If the LDAP security profile already exists, you can modify or delete it by marking it with one of the following function codes (possible code abbreviations are underlined) in column Co:

Components of the LDAP Security Profile

The individual items you can define as part of the LDAP security profile are described below.

LDAP Options 1

Field	Explanation
Profile ID / Profile name	The Natural Security ID and name of the LDAP security profile (cannot be modified).
Authentication type	LDAP (cannot be modified).
Protection level	0 = User authentication is performed by Natural Security. 1 = User authentication is performed via the LDAP server. This applies to Natural online and batch sessions on UNIX and Windows which are started with the Natural profile parameter AUTO=OFF. After successful user authentication, all Natural Security settings apply to defined users (for undefined users, see NSC user ID below). Please note that with LDAP, the password specification is case-sensitive and a password change is not possible. Warning: If you log on to SYSSEC as user "DBA", the user authentication for this user is always performed by Natural Security, even if the protection level is set to "1".
Natural Security system	FSEC (cannot be modified).
Support user names as IDs	This option allows the logon using the user name (as specified in the user security profile) as user ID. This option has three prerequisites. If it is activated (by marking this field with "Y"), an additional screen is displayed on which you have to perform the following checks to ensure that these prerequisites are met: Adabas FDT FSEC system file: In the FDT of the FSEC system file, the field with the Adabas short name "LI" must be defined as a descriptor. This check verifies if this is the case. If it is not, contact your Adabas administrator. Scan FSEC for uniqueness of names: X = All user security profiles will be checked for duplicate or blank user-name entries. D = The result of the check is displayed: a list of all profiles in which the user-name entry is either blank or not unique. W = The result list is written to work file 1. (This requires that the work file has been set at the start of the Natural Security session.) B = The result of the check is both displayed and written to work file 1. Logon exit LOGONSX1 in SYSLIB: The user exit LOGONSX1 must be contained in the library SYSLIB. This check verifies if this is the case.
NSC user ID	This option controls the access of users not defined to Natural Security. N = The general option Transition Period Logon determines to which libraries an undefined users may log on. E = An undefined user may only log on to unprotected libraries (but not to undefined libraries), regardless of the Transition Period Logon setting. Y = An undefined user cannot log on to any library, regardless of the Transition Period Logon setting. P = For all undefined users, access to libraries is determined by a user profile with the ID * LDAP * and user type "E" . Access to a (protected or unprotected) library is only possible by adding this ID to a group which is linked to the library. The ID itself cannot be specified explicitly in the logon procedure. See also External User. If you set this field to "P", this user profile will be added automatically. The user profile is deleted if you change the value of this field from "P" to another value. Modification of this user profile is performed in user maintenance. However, the full set of user maintenance functions is not available for this user profile.
Log file path	The complete path to the file to which the log data are written if the logging of the LDAP-server communication is active. If the specified path contains the character string *USER, this will be replaced by the current value of the Natural system variable *USER.
Log level	This field is used to activate the logging of the LDAP-server communication. Possible values: 0 = Logging is not active. 6 = Logging is active.

LDAP Options 2

LDAP Options 3

PF-Keys

To invoke this function:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select PF-keys.

   The Set PF-Keys screen will be displayed.

3. On this screen, you can assign functions and names to keys, as described below.

Functions can be assigned to certain keys only. Names can be assigned to all keys.

PF-Key Functions

The functions assigned to the following PF-keys cannot be modified:

PF09, PF10, PF11, PA1, PA2

You may assign a function to each of these keys yourself. The function assigned will then be invoked within Natural Security by pressing the appropriate PF-key (or PA-key).

One of the following functions may be assigned to a PF-key (or PA-key):

• a Natural system command,

• a Natural terminal command,

• a Natural program.

To assign a function to a key, you enter a command or program name in the Function column of the Set PF-Keys screen next to a key number.

PF-Key Names

You may name all PF-keys, including those whose function assignments you cannot change. The names may be up to 5 characters long and can be entered in the Name column of the Set PF-Keys screen.

The assigned names will appear in the PF-key lines which are displayed at the bottom of each Natural Security screen:

Enter-PF1---PF2---PF3---PF4---PF5---PF6---PF7---PF8---PF9---PF10--PF11--PF12---
      Help  PrevM Exit  AddOp       Flip  -     +                       Canc

If no name is displayed for a PF-key, this indicates that the function assigned to this key is not applicable to the screen displayed.

The lines display either the keys PF1 to PF12 or the keys PF13 to PF24. By pressing PF6, you can switch from one display to the other, and back again.

Logon/Countersign Errors

The Logon/Countersign Errors functions serve two purposes:

• You can view logon errors, that is, unsuccessful attempts to log on to Natural.

• You can view - and unlock - locked users, that is, users whose IDs have been made invalid due to logon or countersign errors (if the Lock User Option is active).

Logon Errors

In General Options, you can specify the Maximum number of logon attempts by entering a number n in the range from 1 to 5 (the default is 5). Every time a user makes n consecutive unsuccessful logon attempts, the user will be "thrown out" and a logon error record will be written by Natural Security.

A logon error record contains detailed information on each of the n logon attempts that led to the record being written (for example, which user and library IDs were entered by the user). You can view these records with the Logon Error Processing functions. This serves the following purposes:

• You can see whether unauthorized people have tried to gain access to Natural.

• You can see what users do wrong when they try to log on. Users may then be informed how to log on correctly.

• You can see whether users have been given the appropriate access rights. For example, a user may try to log on to an library he/she is not - but should be- allowed to use. You can then make the necessary adjustments to the security profiles and links concerned.

The recording by Natural Security of logon errors cannot be switched off.

Utility Access Errors

Natural Security also records unsuccessful attempts to access a Natural utility. These utility access error records can also be viewed with the Logon/Countersign Errors functions.

Locked Users

If the Lock User Option (see General Options) is active, users may be "locked" due to logon or countersign errors:

• Logon errors:
  Once a user has reached the maximum number of logon attempts without entering the correct password, the user will be locked.

• Countersign errors:
  After entering too many invalid passwords on a countersignature screen, the user who invoked the function requiring the countersignatures will be locked. (For information on countersignatures, see the section Countersignatures.)

With the function List/Unlock Locked Users you can see which users have been locked due to logon or countersign errors. You can also unlock them again.

Countersign errors are only recorded if the Lock User Option is active, whereas logon errors are always recorded (regardless of the Lock User Option).

Invoking Logon/Countersign Errors

To invoke Logon/Countersign Errors:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select Logon/countersign errors.

   The Logon/Countersign Errors Menu will be displayed. It provides the following functions:

   • List error records

   • Delete error records

   • Display individual error records

   • List/unlock locked users

   The individual functions are described below.

Options on the Logon/Countersign Errors Menu

When selecting one of these functions, you can specify the following options:

List Error Records

This function displays a list of logon error records.

The list can be scrolled as described in the section Finding Your Way In Natural Security.

You can change the range of error records listed by entering selection criteria in the input fields above the list. For possible options, enter a question mark (?) in the respective input field(s).

In addition, the following special PF-key functions are available:

To display detailed information on an error record, you mark it with code DI. The Error History of the selected error will be invoked (as with the Display Individual Error Records function; see below).

Delete Error Records

This function displays a list of logon error records, like the List Error Records function described above. The options for handing the list are same as for the List Error Records function. In addition, you can delete logon error records.

It is recommended that logon error records be deleted periodically to save space on the FSEC system file.

• To delete individual error records, you mark them with code DE.

• To delete all error records displayed on the current page, you press PF4.

• To delete all existing error records, you use the direct command ERRDEL (see below).

If an error record has been deleted, this will be indicated by ## in the first column of the list.

Direct Command ERRDEL

To delete all logon/countersign error records at once, you enter the direct command ERRDEL in the command line.

Display Individual Error Records

This function displays the Error History of logon error records one by one.

To delete an error record, you press PF4 on its Error History screen.

List/Unlock Locked Users

This function is only applicable if the Lock User Option (see General Options) is active. It displays a list of those users whose security profiles have been "locked" due to logon or countersign errors. The list is in alphabetical order of user IDs. On the list you can then unlock individual users.

When you invoke the List/Unlock Locked Users function, the List Locked Users screen will be displayed.

The list can be scrolled as described in the section Finding Your Way In Natural Security.

You can change the range of users listed by entering selection criteria in the input fields above the list. For possible options, enter a question mark (?) in the respective input field(s).

The column Lock of the List Locked Users screen indicates the type of error which caused the user to be locked:

For each entry on the List Locked Users screen, the following functions are available:

• To display more detailed information on an entry, mark it with function code DI.

• To unlock a user, mark the entry with function code UL. A window will be displayed, in which you confirm the unlocking by entering a "Y".

Logon Records

Logon records allow you to see which users have been using which libraries.

You can specify the option Logon recorded in the security profile of each library and each user (see the sections Library Maintenance and User Maintenance respectively).

A logon record will be written by Natural Security:

• every time a user logs on to a library in whose security profile the Logon recorded option is set to "Y";

• every time a user in whose security profile the Logon recorded option is set to "Y" logs on to any library.

If the general option Transition Period Logon is set to "Y", a logon record will also be written every time an undefined user logs on (regardless of the setting of the option Logon recorded), and every time a user logs on to an undefined library.

If the user profile item ETID is set to "S" in the Library and User Preset Values (see below), a logon record - with time-stamp-related ETID - will also be written every time a user logs on to Natural (this is only possible if the FUSER system file is not read-only).

Similarly, an access record will be written by Natural Security every time a users invokes a utility in whose default security profile the option Access recorded is set to "Y".

You may view these logon/access records by using the "Logon records" functions.

Invoking Logon Records

To invoke Logon Records:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select Logon Records.

   The Logon Records Menu will be displayed. It provides the following functions:

   • List logon records

   • Delete logon records

   • Delete logon records but last

   The individual functions are described below.

Options on the Logon Records Menu

When you select one of these functions, you can specify the following selection options:

List Logon Records

This function displays a list of logon records.

The list can be scrolled as described in the section Finding Your Way In Natural Security.

You can change the range of logon records listed by entering selection criteria in the input fields above the list. For possible options, enter a question mark (?) in the respective input field(s).

In addition, the following special PF-key functions are available:

Delete Logon Records

This function displays a list of logon records, like the List Logon Records function described above. The options for handing the list are same as for the List Logon Records function. In addition, you can delete logon records.

It is recommended that logon records be deleted periodically to save space on the FSEC system file.

• To delete individual logon records, you mark them with code DE.

• To delete all logon records displayed on the current page, you press PF4.

  If you have invoked the Delete Logon Records function by pressing PF4:Del+ instead of ENTER on the Logon Records Menu, pressing PF4 on the list will automatically scroll to the next page immediately after the deletion, without your having to press PF8.

• To delete all existing logon records, you use the direct command LOGDEL (see below).

• To selectively delete large numbers of logon records, you can use the application programming interface NSCADM.

If a logon record has been deleted, this will be indicated by ## in the first column of the list (except with PF4:Del+).

Direct Command LOGDEL

To delete all logon records at once, you enter the direct command ERRDEL in the command line.

Delete Logon Records But Last

This function corresponds to the Delete Logon Records function described above. However, the only delete options available is to press PF4. If you do so, all logon records displayed on the current page will be deleted - except the latest entry for each user ID on the current page.

Maintenance Log Records

This set of functions can only be used if the general option Logging of Maintenance Functions has been activated. If this option has been activated, log records are written when security profiles and Administrator Services settings are modified. The writing of log records allows you to ascertain who has modified which security profiles and Administrator Services settings. "Modify" in this context comprises all maintenance functions applied to a security profile (including Add, Copy, Delete, Link, etc.); it also includes the transfer of a security profile with the programs SECULD2 and SECLOAD.

To view the log records, you use the "Maintenance log records" functions.

To invoke these functions:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select Maintenance Log Records.

   A menu will be displayed, from which you can select the following functions:

• Display Status of Logging Function

• List Administrator Services Maintenance Logs

• List Security Profile Maintenance Logs

• Log File Maintenance

• List Last Logon Records

Display Status of Logging Function

This function displays the following information:

• for which types of objects log records are written,

• the number of log records that have been written for each type of object,

• whether the option "Logging even if no actual modification" is set or not.

List Administrator Services Maintenance Logs

This function displays a list of the log records that have been written for modifications to Administrator Services settings.

The log records are listed in chronological order.

On the list, the following information is displayed for each log record: the Administrator Services function performed, the ID of the user who made the modification, and the date and time of the modification.

On the list, you can mark a log record with any character: the screen on which the modification was made will then be displayed; on that screen, fields whose values were changed are displayed intensified. The screen also shows the Natural Security version and FSEC system file with/on which the modification was made.

List Security Profile Maintenance Logs

This function displays the log records that have been written for modifications to security profiles.

The log records are listed in chronological order.

On the list, the following information is displayed for each log record: the function performed on the security profile, the ID of the security profile, the ID of the user who made the modification, and the date and time of the modification.

On the list, you can mark a log record with any character: the security profile in which the modification was made will then be displayed. If you press PF2 on the security profile screen, the fields whose values were changed will be displayed intensified (and, if applicable, a message will indicate whether an actual modification was made or not). The screen also shows the Natural Security version and FSEC system file with/on which the modification was made.

Log File Maintenance

On mainframes, this function can only be used in batch mode.

This function allows you to write/read the contents of the log file to/from a work file.

Log records have to be written to a work file when the log file becomes full. Thus, the work file serves as an "archive" for the log records.

The work files to be used are Work File 1 and Work File 5. On UNIX, OpenVMS and Windows, Work File 5 must be a file with the extension ".sag".

The output reports will be written to the print files CMPRT01 and CMPRT02.

When you invoke this function, you will be prompted to specify the database ID and file number of the log file. If you later wish to specify another log file, you press PF5 on the Log File Maintenance menu.

When you invoke this function, the Log File Maintenance menu is displayed, from which you can select the following functions:

The Log File Maintenance function can also be invoked with the direct command LOGFILE.

Possible object types to be entered on the Log File Maintenance menu are:

For object-type codes of external objects, see Types of External Objects.

Other parameters that can be specified on the Log File Maintenance menu are:

Example:

To write log records from the log file to Work File 5, the CMSYNIN batch input file would contain the following commands:

LOGFILE
FIN

The CMOBJIN batch input file might contain the following specifications:

SYSSEC,DBA,PASSWORD
22,241
WR,US,,2002-07-01,2002-07-25

The first line must contain the library ID SYSSEC and the user ID and password of the respective Natural Security administrator.

The second line must contain the database ID and file number of the log file from which the records are read.

The third line must contain the function code and object type (possible values are the same as on the Log File Maintenance menu) - optionally followed by various parameters (whose sequence and possible values correspond to those of the corresponding fields on the Log File Maintenance menu).

When you scan or read the work file, you have to specify the following parameter in the JCL:

WORK=((5),OPEN=ACC)

Sample Batch Job 1 for Mainframes - Writing Log Records to Work File:

//DBA       JOB DBA,CLASS=K,MSGCLASS=X                        
//**
//** WRITE LOGGING OF MAINTENANCE DATA TO WORK FILE 5
//** DELETE RECORDS FROM LOG FILE
//**

//NSCnnBAT EXEC PGM=NATBATnn,REGION=2400K,
// PARM=('IM=D,FNAT=(22,210),INTENS=1,FSEC=(22,240),',
//       'MT=0,MAXCL=0,MADIO=0,AUTO=OFF,WORK=((5),OPEN=ACC)')
//STEPLIB DD   DSN=PRODNAT.LOAD,DISP=SHR
//DDCARD   DD  DISP=SHR,DSN=PRD.NATnn.JOBS(ADADB22)
//CMPRINT  DD  SYSOUT=X
//CMWKF05   DD DSN=NSC.LOG.WKF05,
//    DISP=(NEW,CATLG),DCB=(RECFM=VB,LRECL=4624,BLKSIZE=4628), 
//    SPACE=(TRK,(5,2))
//CMSYNIN   DD *
SYSSEC,DBA,password
LOGFILE
22,241
WD,US,,2002-07-01,2002-07-25
.
FIN
/*
//*

In the above example, the log records of all user security profiles modified between 1st and 25th July 2002 are written to Work File 5, and are then deleted from the log file.

Sample Batch Job 2 for Mainframes - Writing Log Record Reports to Printers:

//DBA       JOB DBA,CLASS=K,MSGCLASS=X                        
//**
//** LIST LOG RECORDS-WRITE REPORTS OF MAINTENANCE DATA TO PRINTER 
//**
//NSCnnBAT EXEC PGM=NATBATnn,REGION=2400K,
// PARM=('IM=D,FNAT=(22,210),INTENS=1,FSEC=(22,240),',
//       'MT=0,MAXCL=0,MADIO=0,AUTO=OFF')
//STEPLIB  DD  DSN=PRODNAT.LOAD,DISP=SHR
//DDCARD   DD  DISP=SHR,DSN=PRD.NATnn.JOBS(ADADB22)
//** CMWKF01   DD DISP=SHR,DSN=NSC.LOG.WKF01
//** CMWKF05   DD DISP=SHR,DSN=NSC.LOG.WKF05
//CMPRINT  DD SYSOUT=X                                
//CMPRT01  DD SYSOUT=X                                
//CMPRT02  DD SYSOUT=X                               
//CMSYNIN  DD *                                       
LOGFILE                                               
FIN                                                   
/*                                                    
//CMOBJIN  DD *                                       
SYSSEC,DBA,password 
22,241                                                
LI,AD,,2002-06-06,2002-06-06                          
LI,US,MILL*,2002-05-01,2002-05-31                     
.                                                     
/*                                                    
//*

In the above example, the log records of all Administrator Services settings modified on 6th June 2002 and of all user security profiles modified in May 2002 are written to the print files CMPRT01 (list of log records) and CMPRT02 (detailed log records information).

Sample Batch Job 3 for Mainframes - Reading Log Records from Work File:

//DBA       JOB DBA,CLASS=K,MSGCLASS=X                        
//**
//** READ LOGGING OF MAINTENANCE DATA FROM WORK FILE 5 
//** INTO LOG FILE
//**   
//NSCnnBAT EXEC PGM=NATBATnn,REGION=2400K,
// PARM=('IM=D,FNAT=(22,210),INTENS=1,FSEC=(22,240),',
//       'MT=0,MAXCL=0,MADIO=0,AUTO=OFF,WORK=((5),OPEN=ACC)')
//STEPLIB DD   DSN=PRODNAT.LOAD,DISP=SHR
//DDCARD   DD  DISP=SHR,DSN=PRD.NATnn.JOBS(ADADB22)
//CMPRINT  DD  SYSOUT=X
//CMWKF05  DD  DSN=NSC.LOG.WKF05,DISP=(SHR)   
//CMSYNIN   DD *
SYSSEC,DBA,password
LOGFILE
22,241
RA,US,,2002-07-01,2002-07-25
.
FIN
/*
//*                                  

In the above example, the log records of all user security profiles modified between 1st and 25th of July 2002 are read from Work File 5 and thus restored on the log file.

See also the section Natural Security In Batch Mode.

List Last Logon Records

This function evaluates the logon records that have been written by Natural Security (see Logon Records ). It allows you to ascertain:

• when each user logged on last,

• which users have not logged on within the last n days.

When you invoke the function, a window will be displayed in which you enter a number of days :

• If you enter a "0", you will get a list of logon records showing the latest logon record written for each user.

• If you enter any other value n, you will get a list of logon records of those users who have not logged on in the last n days, showing for each of those users the last logon record written before the specified time interval.

The logon records are listed in chronological order.

SAF Online Services

SAF Online Services provide several functions for monitoring the SAF server.

SAF Online Services are only available on mainframe computers; they are only available if Natural SAF Security (or any other SAF-related Software AG product) is installed.

Before you can use SAF Online Services, you have to define a utility security profile for the utility SYSSAFOS (which contains the SAF Online Services).

To invoke SAF Online Services:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. On this menu, select SAF Online Services.

   The Online Services menu will be displayed, which provides the following functions:

• System Parameters

• System Statistics

• User Statistics

• Zap Maintenance

• Storage Display

• System Tracing

• Refresh Server

System Parameters

This function displays the parameter settings as defined in the system parameter module. The following information is displayed:

System Statistics

This function displays statistical information on the SAF server. The following information is displayed:

User Statistics

This function displays statistical information on the currently active users. The function displays a list of users. When you select a user from the list, statistical information on this user will be displayed. The individual items correspond to those of the same names as described above for System Statistics.

Zap Maintenance

This function displays a list of ZAPs applied to the SAF server.

Storage Display

This function displays the storage of the SAF server's address space.

System Tracing

This function displays a list of the 256 most recent trace events.

Refresh Server

This function is used to restart the SAF server. It ensures that all data held in the SAF server's own buffer are flushed, including the settings of NSF Options, the System Statistics, cached security checks and user information. In addition, any data held by the security system itself in the address space of the SAF server are flushed when this function is executed.

User Default Profiles

Before you use default profiles, you should be familiar with the "normal" way of defining users as explained in the section User Maintenance.

When you add new users, you can either type in every item of every user security profile by hand, or you can use a pre-defined user default profile as a template for the creation of a user security profile. When you have to define numerous users whose security profiles are to be very similar to one another, you can define in a default profile the items which are to be the same for many users, and then use this default profile as the basis for the individual security profiles. By using default profiles, you can thus reduce the amount of work required to define users to Natural Security.

You create a default profile as described below, and then use it as a template for a user security profile as described in the section User Maintenance.

How to Create a Default Profile

To create a default profile:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. Press PF8.

3. On the Administrator Services Menu 2, select User Default Profiles.

   The Default User Profiles selection list will be displayed.

4. In the command line of this screen, enter the command ADD.

   The Add User Default Profile window will be displayed.

5. In this window, enter the user ID and user type of the default profile.

   For information on user IDs and user types, see the section User Maintenance.

   The Add User Default Profile screen will be displayed.

6. On this screen you define a user default profile.

   The Add User Default Profile screen corresponds more or less to the Add User screen for the same user type. The individual items you may define as part of a user profile are described under Components of a User Profile. However, please note that you can define some items only in an individual security profile, but not in a default profile.

Default profiles are maintained like individual user profiles (as described in the section User Maintenance).

How to Use a Default Profile

When you add a new user, you can specify the ID of a default profile which is to be used as a template for the user security profile you are creating.

The user type of the default profile must be the same as that of the security profile you use it for.

When you use a default profile to add a new user, the items from the default profile are copied into the user profile - except the user ID, user name and the owners.

In the user profile, you can overwrite the items copied from the default profile, and specify further items.

Library Default Profiles

Before you use default library security profiles, you should be familiar with the "normal" way of defining libraries as explained in the section Library Maintenance.

When you add new libraries, you can either type in every item of every library security profile by hand, or you can use a pre-defined default library profile as a template for the creation of a library security profile. When you have to define numerous libraries whose security profiles are to be very similar to one another, you can define in a default profile the items which are to be the same for many libraries, and then use this default profile as the basis for the individual security profiles. By using default library profiles, you can thus reduce the amount of work required to define libraries to Natural Security.

You create a default profile as described below, and then use it as a template for a library security profile as described in the section Library Maintenance.

How to Create a Default Profile

To create a default profile:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. Press PF8.

3. On the Administrator Services Menu 2, select Library Default Profiles.

   The Default Library Profiles selection list will be displayed.

4. In the command line of this screen, enter the command ADD.

   The Add Default Library Profile window will be displayed.

5. In this window, enter the library ID of the default profile (for information on library IDs, see the section Library Maintenance).

   The Add Default Library Profile screen will be displayed.

6. On this screen, you define a default library profile.

   The Add Default Library Profile screen corresponds more or less to the Add Library screen. The individual items you may define as part of a library profile are described under Components of a Library Profile. However, please note that you can define some items only in an individual security profile, but not in a default profile.

Default profiles are maintained like individual library profiles (as described in the section Library Maintenance).

How to Use a Default Profile

When you add a new library, you can specify the ID of a default profile which is to be used as a template for the library security profile you are creating.

When you use a default profile to add a new library, the items from the default profile are copied into the library profile - except the library ID, library name and the owners.

In the library profile, you can overwrite the items copied from the default profile, and specify further items.

Library and User Preset Values

Before you start defining users and libraries to Natural Security, you can use this function to pre-define the values of several items that are part of a library profile and user profile. When you then create a library security profile or user security profile, the items in the profile you are creating are already pre-set to these values.

To invoke this function:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. Press PF8.

3. On the Administrator Services Menu 2, select Library and User Preset Values.

   The first Preset Values screen will be displayed, containing library profile items. A second screen contains user profile items. With PF7 and PF8 you can switch between the two screens.

   With PF5 on the library profile items screen, you can invoke another screen with further library options.

   The items are explained below.

Library Profile Items

Some of these items also appear in the security profile of every library, where their values will be preset to those you specify on the Preset Library Values screen. If the general option Overwriting of defaults possible (see above) is set to "Y", you may overwrite these values in the individual library security profiles. Other items do not directly correspond to library profile fields, but are options which apply to library profiles in general.

Further Library Options

With PF5 on the library profile items screen, you can invoke another screen with these further library options:

• Module Protection Mode
• Disable Rename and Delete of Library Node
• NDV Startup Inactive
• Development Mode
• Natural Client Access
• Library FDIC Assignment Enabled

Module Protection Mode

This option applies to all libraries. It affects the way in which the Disallow/Allow Modules settings in library security profiles are evaluated.

Disable Rename and Delete of Library Node

This option can be used to prevent the inadvertent deletion/renaming of a library in the mapped environment of the Natural Development Server. It applies to the actions Rename and Delete in the context menu of the library node in the mapped environment (see Tree-View Actions in the section Protecting the Natural Development Server Environment and Applications).

NDV Startup Inactive

This option can be used to suppress the execution of startup transactions for logons to libraries in a mapped environment on a Natural Development Server client (see also Map Environment and Library Selection in the section Protecting the Natural Development Server Environment and Applications

This option only takes effect in mapped environments on Natural Development Server clients.

Development Mode

For Natural projects, NaturalONE supports two development modes: shared mode and private mode. This option determines how Natural Security controls the Natural server actions triggered by the Eclipse Navigator view actions used by the Natural projects.

For details, see Protecting the Navigator View in the section Protecting the Natural Development Environment in Eclipse.

Natural Client Access

This option determines which types of clients are permitted to connect to the Natural Development Server:

See also Starting the Natural Development Server in the environment-specific sections of the Natural Development Server documentation.

Library FDIC Assignment Enabled

This option determines if the FDIC system file can be set in library profiles and special-link profiles. It also determines if the FUSER system file and the Cross-reference option can be set in special-link profiles.

The display of the corresponding fields in library and special-link profiles depends on how this option is set.

Once you set this option to "Y", you can only reset it to "N" if no FDIC specification exists in any library or special-link profile, and no FUSER specification in any special-link profile.

For details on how to set the FUSER and FDIC files and the Cross-reference option, see Library File and General Options under Components of a Library Profile.

User Profile Items

Some of these items also appear in the security profile of every user, where their values will be preset to those you specify on the Preset Library And User Values screen. If the general option Overwriting of defaults possible (see above) is set to "Y", you may overwrite these values in the individual user security profiles. Other items do not directly correspond to user profile fields, but are options which apply to user profiles in general.

Password Rules

The following options can only be used if User Password History (see above) is set to "Y" or "*". They allow you to define rules to which user passwords must conform:

Definition of System Libraries

This function is used as part of the installation procedure for an initial installation of Natural Security. It allows you to automatically create library security profiles for system libraries (that is, libraries whose names begin with "SYS") of Natural and its subproducts.

If you use this function, you have to set the Natural profile parameter MADIO to a value of at least 2000.

You should not apply this function to SYS libraries containing Natural utilities, as it is recommended that utilities be protected as described in the section Protecting Utilities.

To define system libraries:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. Press PF8.

3. On the Administrator Services Menu 2, select Definition of System Libraries.

   A list of the system libraries of Natural and all Natural subproducts installed at your site will be displayed. For each system library, a library-specific security profile is provided in which all the necessary components are already defined appropriately.

4. On the list, you can either mark with AD individual libraries to which you wish their pre-defined profiles to be applied one by one, or you can choose to have the pre-defined profiles applied to all product system libraries simultaneously by marking the corresponding product with AD.

For further information, see the Natural Security installation description in the Natural Installation documentation.

Definition of Undefined Libraries

This function is used to create library security profiles for undefined libraries, that is, libraries which exist on the current FUSER system file, but for which no library security profiles have been created.

This function corresponds to that provided by the SHOW command, as described under Listing Undefined Libraries in the section Library Maintenance.

To define undefined libraries:

1. On the Main Menu, select Administrator Services.

   If you are allowed access to Administrator Services, the Administrator Services Menu 1 will be displayed.

2. Press PF8.

3. On the Administrator Services Menu 2, select Definition of Undefined Libraries.

   A list of all undefined will be displayed. It corresponds to the one you get when you issue the command SHOW UNDF on the Library Maintenance selection list.

4. Proceed as described under Listing Undefined Libraries in the section Library Maintenance.