220 lines
14 KiB
HTML
220 lines
14 KiB
HTML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<!DOCTYPE html
|
||
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||
<html lang="en-us" xml:lang="en-us">
|
||
<head>
|
||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||
<meta name="security" content="public" />
|
||
<meta name="Robots" content="index,follow" />
|
||
<meta http-equiv="PICS-Label" content='(PICS-1.1 "http://www.icra.org/ratingsv02.html" l gen true r (cz 1 lz 1 nz 1 oz 1 vz 1) "http://www.rsac.org/ratingsv01.html" l gen true r (n 0 s 0 v 0 l 0) "http://www.classify.org/safesurf/" l gen true r (SS~~000 1))' />
|
||
<meta name="DC.Type" content="concept" />
|
||
<meta name="DC.Title" content="Scenario: Use DCM to sign objects and verify signatures" />
|
||
<meta name="abstract" content="This scenario describes a company that wants to sign vulnerable application objects on their public Web server. They want to be able to more easily determine when there are unauthorized changes to these objects. Based on the company's business needs and security goals, this scenario describes how to use Digital Certificate Manager (DCM) as the primary method for signing objects and verifying object signatures." />
|
||
<meta name="description" content="This scenario describes a company that wants to sign vulnerable application objects on their public Web server. They want to be able to more easily determine when there are unauthorized changes to these objects. Based on the company's business needs and security goals, this scenario describes how to use Digital Certificate Manager (DCM) as the primary method for signing objects and verifying object signatures." />
|
||
<meta name="DC.Relation" scheme="URI" content="rzalzscenariosoverview.htm" />
|
||
<meta name="DC.Relation" scheme="URI" content="rzalzdcmsigndetails.htm" />
|
||
<meta name="DC.Relation" scheme="URI" content="../rzahu/rzahurazhudigitalcertmngmnt.htm" />
|
||
<meta name="copyright" content="(C) Copyright IBM Corporation 2004, 2006" />
|
||
<meta name="DC.Rights.Owner" content="(C) Copyright IBM Corporation 2004, 2006" />
|
||
<meta name="DC.Format" content="XHTML" />
|
||
<meta name="DC.Identifier" content="dcmsignsc" />
|
||
<meta name="DC.Language" content="en-us" />
|
||
<!-- All rights reserved. Licensed Materials Property of IBM -->
|
||
<!-- US Government Users Restricted Rights -->
|
||
<!-- Use, duplication or disclosure restricted by -->
|
||
<!-- GSA ADP Schedule Contract with IBM Corp. -->
|
||
<link rel="stylesheet" type="text/css" href="./ibmdita.css" />
|
||
<link rel="stylesheet" type="text/css" href="./ic.css" />
|
||
<title>Scenario: Use DCM to sign objects and verify signatures</title>
|
||
</head>
|
||
<body id="dcmsignsc"><a name="dcmsignsc"><!-- --></a>
|
||
<!-- Java sync-link --><script language="Javascript" src="../rzahg/synch.js" type="text/javascript"></script>
|
||
<h1 class="topictitle1">Scenario: Use DCM to sign objects and verify signatures</h1>
|
||
<div><p>This scenario describes a company that wants to sign vulnerable
|
||
application objects on their public Web server. They want to be able to more
|
||
easily determine when there are unauthorized changes to these objects. Based
|
||
on the company's business needs and security goals, this scenario describes
|
||
how to use Digital Certificate Manager (DCM) as the primary method for signing
|
||
objects and verifying object signatures.</p>
|
||
<div class="section"><h4 class="sectionscenariobar">Situation</h4><p> As an
|
||
administrator for MyCo, Inc. you are responsible for managing your company's
|
||
two systems. One of these systems provides a public Web site for your company.
|
||
You use the company's internal production system to develop the content for
|
||
this public Web site and transfer the files and program objects to the public
|
||
Web server after testing them. </p>
|
||
<p>The company's public Web server provides
|
||
a general company information Web site. The Web site also provides various
|
||
forms that customers fill out to register products, and to request product
|
||
information, product update notices, product distribution locations, and so
|
||
forth. You are concerned about the vulnerability of the cgi-bin programs that
|
||
provide these forms; you know that they might be altered. Therefore, you want
|
||
to be able to check the integrity of these program objects and to detect when
|
||
unauthorized changes have been made to them. Consequently, you have decided
|
||
to digitally sign these objects to accomplish this security goal. </p>
|
||
<p>You
|
||
have researched i5/OS™ object
|
||
signing capabilities and have learned that there are several methods that
|
||
you can use to sign objects and verify object signatures. Because you are
|
||
responsible for managing a small number of systems and do not feel that you
|
||
will need to sign objects often, you have decided to use Digital Certificate
|
||
Manager (<a href="../rzahu/rzahurazhudigitalcertmngmnt.htm">DCM</a>) for performing these tasks. You have also decided
|
||
to create a Local Certificate Authority (CA) and use a private certificate
|
||
to sign objects. Using a private certificate issued by a Local CA for object
|
||
signing limits the expense of using this security technology because you do
|
||
not have to purchase a certificate from a well-known public CA.</p>
|
||
<p>This
|
||
example serves as a useful introduction to the steps involved in setting up
|
||
and using object signing when you want to sign objects on a small number of
|
||
systems.</p>
|
||
</div>
|
||
<div class="section"><h4 class="sectionscenariobar">Scenario advantages</h4><p>This
|
||
scenario has the following advantages:</p>
|
||
<ul><li>Signing objects provides you with a means to check the integrity of vulnerable
|
||
objects and more easily determine whether objects have been changed after
|
||
they have been signed. This may reduce some of the troubleshooting that you
|
||
do in the future to track down application and other system problems.</li>
|
||
<li>Using DCM's graphical user interface (GUI) to sign objects and verify
|
||
object signatures allows you and others in the company to perform these tasks
|
||
quickly and easily.</li>
|
||
<li>Using DCM to sign objects and verify object signatures reduces the amount
|
||
of time you must spend to understand and use object signing as part of your
|
||
security strategy.</li>
|
||
<li>Using a certificate issued by a Local Certificate Authority (CA) to sign
|
||
objects makes signing objects less expensive to implement.</li>
|
||
</ul>
|
||
</div>
|
||
<div class="section"><h4 class="sectionscenariobar">Objectives</h4><p>In this
|
||
scenario, you want to digitally sign vulnerable objects, such as cgi-bin programs
|
||
that generate forms, on your company's public server. As the system administrator
|
||
at MyCo, Inc, you want to use Digital Certificate Manager (DCM) to sign these
|
||
objects and to verify the signatures on the objects. </p>
|
||
<p>The objectives
|
||
for this scenario are as follows:</p>
|
||
<ul><li>Company applications and other vulnerable objects on the public Web server
|
||
(System B) must be signed with a certificate from a Local CA to limit the
|
||
costs of signing applications.</li>
|
||
<li>System administrators and other designated users must be able to easily
|
||
verify digital signatures on systems to verify the source and authenticity
|
||
of company signed objects. To accomplish this, each system must have a copy
|
||
of both the company's signature verification certificate and the Local Certificate
|
||
Authority (CA) certificate in each server's *SIGNATUREVERIFICATION certificate
|
||
store.</li>
|
||
<li>By verifying the signatures on company applications and other objects,
|
||
administrators and others can detect whether the content of the objects has
|
||
changed since they were signed.</li>
|
||
<li>The system administrator must use DCM to sign objects; the system administrator
|
||
and others must be able to use DCM to verify object signatures.</li>
|
||
</ul>
|
||
</div>
|
||
<div class="section"><h4 class="sectionscenariobar">Details</h4><p>The following
|
||
figure illustrates the object signing and signature verification process for
|
||
implementing this scenario:</p>
|
||
<br /><img src="rzalz001.gif" alt="Fig. 1 DCM object signing process illustration (text description follows figure)" /><br /><p>The figure illustrates the
|
||
following points relevant to this scenario:</p>
|
||
<p><strong>System A</strong></p>
|
||
<ul><li>System A runs i5/OS Version 5 Release 2 (V5R2). </li>
|
||
<li>System A is the company's internal production server and development platform
|
||
for the public iSeries™ Web
|
||
server (System B).</li>
|
||
<li>System A has a Cryptographic Access Provider 128-bit for iSeries (5722–AC3)
|
||
installed.</li>
|
||
<li>System A has Digital Certificate Manager (i5/OS option 34) and the IBM<sup>®</sup> HTTP Server
|
||
(5722–DG1) installed and configured.</li>
|
||
<li>System A acts as the Local Certificate Authority (CA) and the object signing
|
||
certificate resides on this system.</li>
|
||
<li>System A is uses DCM to sign objects and is the primary object signing
|
||
system for the company's public applications and other objects.</li>
|
||
<li>System A is configured to enable signature verification.</li>
|
||
</ul>
|
||
<p><strong>System B</strong></p>
|
||
<ul><li>System B runs i5/OS Version 5 Release 1 (V5R1). </li>
|
||
<li>System B is the company's external public Web server outside the company's
|
||
firewall.</li>
|
||
<li>System B has a Cryptographic Access Provider 128-bit (5722–AC3) installed.</li>
|
||
<li>System B has Digital Certificate Manager (i5/OS option 34) and the IBM HTTP Server
|
||
(5722–DG1) installed and configured.</li>
|
||
<li>System B does not operate a Local CA, nor does System B sign objects. </li>
|
||
<li>System B is configured to enable signature verification by using DCM to
|
||
create the *SIGNATUREVERIFICATION certificate store and import the needed
|
||
verification and Local CA certificates.</li>
|
||
<li>DCM is used to verify signatures on objects.</li>
|
||
</ul>
|
||
</div>
|
||
<div class="section"><h4 class="sectionscenariobar">Prerequisites and assumptions</h4><p>This
|
||
scenario depends on the following prerequisites and assumptions: </p>
|
||
<ol><li>All systems meet the <a href="../rzahu/rzahurzahureqdcmrequirements.htm">requirements</a> for installing and using Digital Certificate
|
||
Manager (DCM).</li>
|
||
<li>No one has previously configured or used DCM on any of the systems.</li>
|
||
<li>All systems have the highest level of Cryptographic Access Provider 128-bit
|
||
licensed program (5722-AC3) installed. </li>
|
||
<li>The default setting for the verify object signatures during restore (<a href="../rzakz/rzakzqvfyobjrst.htm ">QVFYOBJRST</a>)
|
||
system value on all scenario systems is 3 and has not been changed from this
|
||
setting. The default setting ensures that the server can verify object signatures
|
||
as you restore the signed objects. </li>
|
||
<li>The system administrator for System A must have *ALLOBJ special authority
|
||
to sign objects, or the user profile must be authorized to the object signing
|
||
application. </li>
|
||
<li>The system administrator or anyone else who creates a certificate store
|
||
in DCM must have *SECADM and *ALLOBJ special authorities.</li>
|
||
<li>The system administrator or others on all other systems must have *AUDIT
|
||
special authority to verify object signatures.</li>
|
||
</ol>
|
||
</div>
|
||
<div class="section"><h4 class="sectionscenariobar">Configuration task steps</h4><p>There
|
||
are two sets of tasks that you must complete to implement this scenario: One
|
||
set of tasks allows you to configure System A as a Local Certificate Authority
|
||
(CA) and to sign and verify object signatures. The second set of tasks allows
|
||
you to configure System B to verify object signatures that System A creates. </p>
|
||
<p>See
|
||
the scenarios details topic presented below to complete these steps.</p>
|
||
<p><strong>System
|
||
A task steps</strong></p>
|
||
<p>You must complete each of these tasks on System A to
|
||
create a private Local CA and to sign objects and verify the object signature
|
||
as this scenario describes:</p>
|
||
<a name="dcmsignsc__dcmsignsteps"><!-- --></a><ol id="dcmsignsc__dcmsignsteps"><li>Complete all prerequisite steps to install and configure all needed iSeries products</li>
|
||
<li>Use DCM to create a Local Certificate Authority (CA) to issue an object
|
||
signing certificate. </li>
|
||
<li>Use DCM to create an application definition</li>
|
||
<li>Use DCM to assign a certificate to the object signing application definition</li>
|
||
<li>Use DCM to sign the cgi-bin program objects</li>
|
||
<li>Use DCM to export the certificates that other systems must use for verifying
|
||
object signatures You must export both a copy of the Local CA certificate
|
||
and a copy of the object signing certificate as a signature verification certificate
|
||
to a file.</li>
|
||
<li>Transfer the certificate files to the company's public server (System
|
||
B) so that you and others can verify the signatures that System A creates</li>
|
||
</ol>
|
||
<p><strong>System B task steps</strong></p>
|
||
<p>If you intend to restore the signed
|
||
objects that you transfer to the public Web server in this scenario (System
|
||
B), you need to complete these signature verification configuration tasks
|
||
on System B before you transfer the signed objects. Signature verification
|
||
configuration must be completed before you can successfully verify signatures
|
||
as you restore the signed objects on the public Web server.</p>
|
||
<p>On System
|
||
B, you must complete these tasks to verify signatures on objects as this scenario
|
||
describes:</p>
|
||
<ol><li>Use Digital Certificate Manager (DCM) to create the *SIGNATUREVERIFICATION
|
||
certificate store</li>
|
||
<li>Use DCM to import the Local CA certificate and the signature verification
|
||
certificate</li>
|
||
<li>Use DCM to verify the signatures on transferred objects</li>
|
||
</ol>
|
||
</div>
|
||
</div>
|
||
<div>
|
||
<ul class="ullinks">
|
||
<li class="ulchildlink"><strong><a href="rzalzdcmsigndetails.htm">Scenario details: Use DCM to sign objects and verify signatures</a></strong><br />
|
||
Complete the following task steps to configure and use Digital Certificate Manager to sign objects as this scenario describes.</li>
|
||
</ul>
|
||
|
||
<div class="familylinks">
|
||
<div class="parentlink"><strong>Parent topic:</strong> <a href="rzalzscenariosoverview.htm" title="Use this information to review scenarios that illustrate some typical situations for using object signing and signature verification capabilities. Each scenario also provides the configuration tasks you must perform to implement the scenario as described.">Object signing scenarios</a></div>
|
||
</div>
|
||
<div class="relinfo"><strong>Related information</strong><br />
|
||
<div><a href="../rzahu/rzahurazhudigitalcertmngmnt.htm">Digital Certificate Manager (DCM)</a></div>
|
||
</div>
|
||
</div>
|
||
</body>
|
||
</html> |