Implementing Security with CA ACF2 › External Communicators with CA ACF2 › Terminal Communication

Terminal Communication

Each of the following lets you send terminal commands to CA WA CA 7 Edition:

• Batch Terminal Interface (SASSBSTR)
• Trailer facility (SASSTRLR)
• CAICCI Interface (CAL2X2W0)
• TCP/IP Interface (CAL2X2T0)
• U7SVC

Although no online terminal is used with this mode of communication, input from these programs is treated as terminal input by CA WA CA 7 Edition. Command security in these environments is handled as it is for all CA WA CA 7 Edition terminals. CA ACF2 controls access to CA WA CA 7 Edition commands when EXTERNAL=COMMAND is specified on the SECURITY statement in the CA WA CA 7 Edition initialization file. CA ACF2 determines a user's access to CA WA CA 7 Edition terminal commands based on the LOGONID supplied on the /LOGON command. Thus, when using an External Communicator, a CA WA CA 7 Edition /LOGON command must precede any command input.

CA ACF2 typically requires a password at logon. But including passwords in command input for the External Communicators would obviously represent a serious security exposure. Several checks can be made to avoid the need to include passwords in command input when using these facilities. If no /LOGON command is found in the command input, a /LOGON statement is built using the LOGONID associated with the current user. Under certain conditions, it is not possible to extract the LOGONID associated with the user of the External Communicator. In that event, a /LOGON statement is built using a default LOGONID of CA7DUMMY. If a /LOGON statement is found in the command input, the current user's authority to use the LOGONID found on the /LOGON statement may be checked. If the LOGONID found on the /LOGON statement matches the LOGONID of the current user, it is assumed that the user has the authority to use the LOGONID. If the LOGONIDs differ, a check may be made to validate the user's READ access to a resource whose name is the LOGONID found on the /LOGON statement. The generalized resource type is SUB. Rules for this resource should be written to reflect the security needs of your installation. If a /LOGON statement was generated or if the user's authority to use a LOGONID was successfully validated then CA WA CA 7 Edition allows the user to LOGON without a password.

The USERID of the current user is determined by using CAS9 CAISSF services.

Note: For more information about CAISSF, see the CA Common Services documentation.

The value of BSUBCHK that CAIRIM sets controls submit checking for External Communicators.

Note: For more information, see the chapter "Execution" in the Systems Programming Guide.