Implementing Security with CA Top Secret › External Communicators with CA Top Secret › Terminal Communication

Terminal Communication

Each of the following lets you send terminal commands to CA WA CA 7 Edition:

• Batch Terminal Interface (SASSBSTR)
• Trailer facility (SASSTRLR)
• CAICCI Interface (CAL2X2W0)
• TCP/IP Interface (CAL2X2T0)
• U7SVC

Although no online terminal is used with this mode of communication, input from these programs is treated as terminal input by CA WA CA 7 Edition. Command security in these environments is handled as it is for all CA WA CA 7 Edition terminals. CA Top Secret controls access to CA WA CA 7 Edition commands when EXTERNAL=COMMAND is specified on the SECURITY statement in the initialization file. CA Top Secret determines a user's access to CA WA CA 7 Edition terminal commands based on the USERID supplied on the /LOGON command. Thus, when using an External Communicator, any command input must precede a /LOGON command.

CA Top Secret typically requires a password at logon. But including passwords in command input for the External Communicators would obviously represent a serious security exposure. Several checks are made to avoid the need to include passwords in command input when using these facilities. If no /LOGON command is found in the command input, a /LOGON statement is built using the USERID associated with the current user. Under certain conditions, it is not always possible to extract the USERID associated with the user of the External Communicator. In that event, a /LOGON statement is built using a default USERID of CA7DUMMY. If a /LOGON statement is found in the command input, the current user's authority to use the USERID found on the /LOGON statement can be checked. If the USERID found on the /LOGON statement matches the USERID of the current user, it is assumed that the user has the authority to use the USERID. If the USERIDs differ, a check can be made to validate the user's READ access to an entity whose name is the USERID found on the /LOGON statement. The CA Top Secret PERMIT command can be used to define this relationship in the same way shown in the control job submission under CA WA CA 7 Edition topic. If a /LOGON statement was generated or if the user's authority to use a USERID was successfully validated, CA WA CA 7 Edition allows the user to LOGON without a password.

The USERID of the current user is determined by using CAS9 SSF services.

Note: For more information about SSF, see the CA Common Services documentation.

Submit checking for External Communicators is controlled by the value of BSUBCHK that is set by CAIRIM.

Note: For more information, see the chapter "Execution" in the Systems Programming Guide.