ClearPath MCP 21.0
June 2023
8205 7498-003
Copyright © 2023 Unisys Corporation.
Warranty Disclaimer
NO WARRANTIES OF ANY NATURE ARE EXTENDED BY THIS DOCUMENT. Any product or related information described herein is only furnished pursuant and subject to the terms and conditions of a duly executed agreement to purchase or lease equipment or to license software. The only warranties made by Unisys, if any, with respect to the products described in this document are set forth in such agreement. Unisys cannot accept any financial or other responsibility that may be the result of your use of the information in this document or software material, including direct, special, or consequential damages.
You should be very careful to ensure that the use of this information and/or software material complies with the laws, rules, and regulations of the jurisdictions with respect to which it is used.
The information contained herein is subject to change without notice. Revisions may be issued to advise of such changes and/or additions.
Notice to U.S. Government End Users: This software and any accompanying documentation are commercial items which have been developed entirely at private expense. They are delivered and licensed as commercial computer software and commercial computer software documentation within the meaning of the applicable acquisition regulations. Use, reproduction, or disclosure by the Government is subject to the terms of Unisys’ standard commercial license for the products, and where applicable, the restricted/limited rights provisions of the contract data rights clauses.
Table of Contents
- Introduction
- MCP Security Overview
-
- Access Control
- Authentication
- Cryptography
- Network Security
- Audit and Assessment
- Codefile Verification
- Installation Best Practices
- Controlling System Access
- Controlling File Access
-
- Mechanisms for Protecting Files
- Controlling Group Access to Files
- MCP File Access Management Feature in Security Center
- Controlling Printing
- Controlling Tape File Access
- Encrypting Library Maintenance Tapes, CDs and DVDs
- Encrypting Disks
- Protecting Potentially Hazardous Files
- Using Permanent Directories
- Securing Wrapped and Container Files
- Controlling Host Access
-
- General Network Security Features
- TCP/IP Network Security Features
-
- TCP/IP Access Control
- Identification in a TCP/IP Network
- Access to TCP/IP Network Commands
- TCP/IP Filtering
- Port Filtering
- Dynamic Port Filtering
- Broadcast Filtering
- Enabling Port and Broadcast Filtering
- Secure Sockets Layer (SSL)/Transport Layer Security (TLS)
- Secure Shell (SSH)
- Web Transaction Server for ClearPath MCP
- Telnet
- Internet Protocol Security (IPsec)
- Client Access Services Network Security Features
- Kerberos Security Features
- Authentication Support Features
- Connectivity Services Security Features
- BNA Network Security Features
- TCP/IP Filtering
- Security with Web Transaction Server and WEBPCM
-
- Web Transaction Server
-
- Identifying Users and Allocating Access Rights
- Tracking User Access
- Restricting and Limiting User Access
- Delaying Authentication Responses
- Web Transaction Server Administration Security
- Detecting User Break-In Attempts
- Localizing Security Rules
- Data Transparency
- TCP/IP Filtering
- Digest Authentication Is Unsupported
- Using Web Transaction Server Site Manager to Configure Secure Transport
- Requesting Client Certificates and Restricting Access
- Hiding Server Identity
- Use of Web Transaction Server with NTLM and Kerberos
- WEBPCM
- NXSERVICES CREDENTIALS Files
- Extension Kit for MCP Security Overview
- Security Configuration
-
- Maintaining System Security
- General Security Considerations
- Introduction to Security Center
-
- Overview of Security Center
- Locum SafeSurvey Client
- Locum SecureAudit Client
- Locum RealTime Config
- Role-Based Access Control
- Operation of Security Center
- Security Center Guard File
- Troubleshooting Connection and Access Problems
- Installing Security Center
- Migrating and Upgrading Security Center
- Key Manager Library
- Support for Role-Based Access Control in the Application Environment
- Defining a User with Standard Usercode Attributes
- Security Configuration Best Practices
- Network Security and Cryptography Services
-
- Network Security Services
- MCP Cryptographic Services
- Installing Security Components
- Configuration
- Diagnostics Logging and Troubleshooting
- Audit and Compliance
- References and Related Documents
List of Figures
List of Tables
- 1. CLASS Security Option Values
- 2. CLASS Security Option Results (Value U)
- 3. CLASS Security Option Results (Values S0 – S2)
- 4. S1RESTRICTIONS and S2RESTRICTIONS Security Option Results
- 5. SECOPT Command Examples
- 6. SECOPT Option Purposes
- 7. SECOPT Command CANDE Option Values
- 8. SECOPT MECHANISMS Command Options
- 9. SECOPT MECHANISMS Command Option Attribute Values
- 10. SECOPT MECHANISMS Command Examples
- 11. Station Transaction Server Access Rights in a High-Security System
- 12. Log-On Identification Items
- 13. Types of Nonusercoded System Access
- 14. Required Secure Access Control Module Software
- 15. Usercode Restriction Options
- 16. Password Attributes
- 17. USERDATAFILE Attribute Settings for No System Security
- 18. USERDATAFILE Attribute Settings for Medium System Security
- 19. USERDATAFILE Attribute Settings for High System Security
- 20. Transaction Server Control-Capable Options
- 21. Security Specification Interaction
- 22. Methods for Assigning Transaction Server Control Capability
- 23. MONITOR Command Examples
- 24. Transaction Server Access Rights for Systems with Minimal Security
- 25. Transaction Server Access Rights for Systems with Medium Security
- 26. Transaction Server Access Rights for Systems with High Security
- 27. CANDE ?OP Command Options
- 28. Operations Affecting Tape Volume Attributes
- 29. Tape Volume Attributes Affected by Operations
- 30. LISTVOLUME Report for the Volume Directory
- 31. SL Command Options
- 32. Network Service Function Levels
- 33. BNA Node Access Control Levels
- 34. Network Prefix (NW) BNA Commands
- 35. Component Field Syntax
- 36. Codes Reported at the Security Center Workstation Client
- 37. Codes Reported at the ODT
- 38. Realm Descriptor Attributes for USERDATA
- 39. Usercode Attributes
- 40. LOGSELECT Values 0–7
- 41. LOGSELECT Values 8–15
- 42. USEDEFAULTCHARGE Summary
- 43. System-Maintained Usercode Attributes
- 44. Changing Nonprivileged Usercode Example
- 45. Log Entry Classes
- 46. Security Violation Codes
- 47. Violations That Do Not Increment Violation Counts
- 48. Networking Commands by Code
- 49. Networking Reports by Code
- 50. Networking Log-Only Reports by Code
