Horizon network security - Revision history

JAL: link repair

2015-10-13T21:52:17Z

link repair

← Older revision		Revision as of 21:52, 13 October 2015
Line 916:		Line 916:
	==<b id="example4"></b>Example 4: Protecting the Client Process Definition==		==<b id="example4"></b>Example 4: Protecting the Client Process Definition==
	<p>		<p>
	The sample application is revised so that the service program now performs some updates. (Note that only one node is updated by a given transaction. As discussed in [[Horizon ~~User Language (~~SOUL) sample programs]], a two-node update can cause problems at recovery time.) An incorrectly written client request that OPENs the PROCESS may cause data corruption on the server system. To prevent ad hoc client requests from using the process definition, the client system manager makes the following adjustment.</p>		The sample application is revised so that the service program now performs some updates. (Note that only one node is updated by a given transaction. As discussed in [[Horizon SOUL sample programs]], a two-node update can cause problems at recovery time.) An incorrectly written client request that OPENs the PROCESS may cause data corruption on the server system. To prevent ad hoc client requests from using the process definition, the client system manager makes the following adjustment.</p>

	===Coding for client===		===Coding for client===

JAL: link repair

2015-10-13T20:40:38Z

link repair

← Older revision		Revision as of 20:40, 13 October 2015
Line 374:		Line 374:
	===For more information===		===For more information===
	<p>		<p>
	Coding the SNA Communications Server APPL definition is described further in [[~~Network Management~~#Defining the Network to SNA Communications Server\|Defining the Network to SNA Communications Server]]. The DEFINE LINK command is described in [[~~Network Management~~#Defining a Horizon network\|Defining a Horizon network]].</p>		Coding the SNA Communications Server APPL definition is described further in [[Horizon network management#Defining the Network to SNA Communications Server\|Defining the Network to SNA Communications Server]]. The DEFINE LINK command is described in [[Horizon network management#Defining a Horizon network\|Defining a Horizon network]].</p>

	==Security Design Examples==		==Security Design Examples==

JAL: link repair

2015-10-13T20:39:19Z

link repair

← Older revision		Revision as of 20:39, 13 October 2015
Line 56:		Line 56:
	For a client system to establish an SNA session with a Model 204 server, the client's network node name must be coded in the REMOTEID parameter of a server's DEFINE PROCESSGROUP command. Since this command requires system manager privileges, a given client system must be specifically authorized by a server's system manager to gain access to the server. </p>		For a client system to establish an SNA session with a Model 204 server, the client's network node name must be coded in the REMOTEID parameter of a server's DEFINE PROCESSGROUP command. Since this command requires system manager privileges, a given client system must be specifically authorized by a server's system manager to gain access to the server. </p>
	<p>		<p>
	For example, referring to the figure "Logical network view from New York and Boston" in [[~~Network~~ management]], the following abbreviated DEFINE PROCESSGROUP command allows sessions with the network node M204HQ:</p>		For example, referring to the figure "Logical network view from New York and Boston" in [[Horizon network management]], the following abbreviated DEFINE PROCESSGROUP command allows sessions with the network node M204HQ:</p>

	<p class="code">DEFINE PROCESSGROUP PGRP1 WITH REMOTEID=M204HQ... </p>		<p class="code">DEFINE PROCESSGROUP PGRP1 WITH REMOTEID=M204HQ... </p>
Line 64:		Line 64:
	For a given server program (that is, application subsystem or procedure) to be accessible from any client system, the server system manager must include the name of a processgroup that defines that client system in the FROM parameter of the server program's process definition. The system manager is thus required to tell Model 204 explicitly which nodes in the network may access any server program. </p>		For a given server program (that is, application subsystem or procedure) to be accessible from any client system, the server system manager must include the name of a processgroup that defines that client system in the FROM parameter of the server program's process definition. The system manager is thus required to tell Model 204 explicitly which nodes in the network may access any server program. </p>
	<p>		<p>
	For example, referring to the figure "Logical network view from New York and Boston" in [[~~Network~~ management]], the following abbreviated DEFINE PROCESS command allows access to the server program WSALES from the client system M204HQ (which is defined in processgroup PGRP1):</p>		For example, referring to the figure "Logical network view from New York and Boston" in [[Horizon network management]], the following abbreviated DEFINE PROCESS command allows access to the server program WSALES from the client system M204HQ (which is defined in processgroup PGRP1):</p>

	<p class="code">DEFINE PROCESS WSALES FROM=PGRP1... </p>		<p class="code">DEFINE PROCESS WSALES FROM=PGRP1... </p>

JAL: link repair

2015-10-13T20:35:58Z

link repair

← Older revision		Revision as of 20:35, 13 October 2015
Line 224:		Line 224:
	</ul>		</ul>
	<p>		<p>
	This section contains a brief summary of how the subsystem handles these three security concerns. For a more thorough description of application subsystems, see [[System requirements for ~~application subsystems~~]].</p>		This section contains a brief summary of how the subsystem handles these three security concerns. For a more thorough description of application subsystems, see [[System requirements for Application Subsystems]].</p>
	====Controlling who is allowed in====		====Controlling who is allowed in====
	<p>		<p>
Line 242:		Line 242:
	The privileges set in the SCLASS definition are equivalent to the user privileges ordinarily granted upon successful login to Model 204: the power to create files, issue certain privileged commands, change passwords, or access secured records. </p>		The privileges set in the SCLASS definition are equivalent to the user privileges ordinarily granted upon successful login to Model 204: the power to create files, issue certain privileged commands, change passwords, or access secured records. </p>
	<p>		<p>
	For more information about these privileges, see [[System requirements for ~~application subsystems~~]].</p>		For more information about these privileges, see [[System requirements for Application Subsystems]].</p>
	<p>		<p>
	The SCLASS may also define the account name the user is assigned while in the subsystem, and may also define the record security key for the user.</p>		The SCLASS may also define the account name the user is assigned while in the subsystem, and may also define the record security key for the user.</p>

ELowell: /* Login options */

2015-09-30T19:33:47Z

← Older revision		Revision as of 19:33, 30 September 2015
Line 103:		Line 103:
	The following figure is a hierarchical representation of the various Horizon security options that affect login for a client user trying to run a server program. </p>		The following figure is a hierarchical representation of the various Horizon security options that affect login for a client user trying to run a server program. </p>

	<~~IMG SRC~~="~~CHAP4-3.gif~~" ~~USEMAP~~="~~#CHAP4-3~~">		<p class="caption" style="width:468px">Login security processing</p>
			<p class="figure">[[File:Horizon_fig4-2_login_security_proc.gif]] </p>
	<p class="figure">
	~~<caption>Login security processing</caption>~~
	</p>

	====Login required====		====Login required====
	<p>		<p>

ELowell: /* Managing access to a server system */

2015-09-30T19:32:25Z

Managing access to a server system

← Older revision		Revision as of 19:32, 30 September 2015
Line 45:		Line 45:
	<p>		<p>
	The figure "Lines of defense for a server system" shows how these issues represent layers of protection for the server system, and how access is controlled. Refer to it during the discussion of access to a server system.</p>		The figure "Lines of defense for a server system" shows how these issues represent layers of protection for the server system, and how access is controlled. Refer to it during the discussion of access to a server system.</p>
			<p class="caption" style="width:550px">Lines of Defense for a Server System</p>
	<~~IMG SRC~~="~~CHAP4-2.gif" USEMAP="#CHAP4-2~~">		<p class="figure">[[File:Horizon_fig4-1_lines_of_defense.gif]]</p>

	~~<p class~~="~~figure~~">
	~~<caption~~>Lines of Defense for a Server System</~~caption~~>
	</p>

	==Controlling remote client system access to the server==		==Controlling remote client system access to the server==

ELowell: Created page with "==Overview==
A distributed transaction consists of at least two parts: the part that requests a remote service (the client), and the part that services the request (the se..."

2015-09-30T19:26:43Z

Created page with "==Overview== <p> A distributed transaction consists of at least two parts: the part that requests a remote service (the client), and the part that services the request (the se..."

Show changes

Horizon network security - Revision history

JAL: link repair

JAL: link repair

JAL: link repair

JAL: link repair

ELowell: /* Login options */

ELowell: /* Managing access to a server system */

ELowell: Created page with "==Overview== A distributed transaction consists of at least two parts: the part that requests a remote service (the client), and the part that services the request (the se..."

ELowell: Created page with "==Overview==
A distributed transaction consists of at least two parts: the part that requests a remote service (the client), and the part that services the request (the se..."