Chapter 11 Security Configuration Tasks

Configuring security profiles

Security profiles define the security characteristics of a client-EAServer session. You assign a security profile to a listener, which is a port that accepts client connection requests of various protocols. EAServer can support multiple listeners. Clients that support the same characteristics can communicate to EAServer via the port defined in the listener.

Each security profile has an associated security characteristic. A security characteristic is a name that has a set of CipherSuites associated with it. A security characteristic, along with the CipherSuites, defines these characteristics of a client/server connection:

• Protocol All profiles use SSL version 3 as the underlying protocol. IIOPS and HTTPS traffic is tunneled through SSL.
• Authentication Whether or not authentication is used. Profiles can support:
  • No authentication - neither client nor server need to provide a certificate for authentication.
  • Server authentication - only the server needs to provide a certificate to be accepted or rejected by the client.
  • Client and server authentication - both the client and server supply certificates to be accepted or rejected by the other.
• Encryption strength and method Whether or not data is encrypted, and if so, the key strength and method of the encryption.
• International use All CipherSuites are available domestically, but not all are suitable for export outside of the United States and Canada.
• Hashing method The method used to create the message digest.

For example, the CipherSuite SSL_RSA_WITH_NULL_MD5 can be interpreted as:

SSL - the protocol used. All profiles use SSL.

RSA - the key exchange algorithm used.

NULL - no encryption.

MD5 - the hash method used to compute the message digest.

Table 11-1 and Table 11-2 clarify the relationship between CipherSuite terminology and security characteristics.

   Browsers do not support anonymous CipherSuites.

There are four categories of security characteristics:

• Simple The predefined characteristics sybpks_simple and sybpks_simple_mutual_auth offer authentication but no encryption.
• Strong The predefined characteristics sybpks_strong and sybpks_strong_mutual_auth offer greater domestic encryption strength.
• Domestic All characteristics are suitable for domestic use. Clients using international CipherSuites can connect to servers using domestic security characteristics.
• International Because of export regulations, only these characteristics are suitable for export:
  • sybpks_simple
  • sybpks_simple_mutual_auth
  • sybpks_intl
  • sybpks_intl_mutual_auth

Table 11-2 lists the name, the level of authentication, and the supported CipherSuites for each security characteristic.

Defining security profiles

This section describes how to create, modify, and delete a security profile. All of the configuration tasks require you to first access the Security Profiles folder. To do this, highlight the Security Profiles folder from Jaguar Manager.

See Table 11-3 when creating, modifying, or deleting a security profile.

Creating a new security profile

1. Select File | New Security Profile.
2. Enter the name of the new security profile. Click Create New Security Profile.
3. Complete the Security Profile sheet. Click Advanced to modify the default settings for the advanced SSL settings. Click Save. See "General, advanced, and Entrust profile properties " for a description of the security profile properties.
   
   If you are using an Entrust ID, select the Use Entrust check box. Click the Entrust Tab and provide the Entrust information required to access your Entrust ID.

The new security profile now appears on the right side of the window when the Security Profiles folder on the left side of the window is highlighted.

Modifying an existing security profile

1. Highlight the security profile you want to modify.
2. Select File | Security Profile Properties.
3. Modify the properties. Click Save when finished. See "General, advanced, and Entrust profile properties " for a description of the profile properties.

Deleting a security profile

1. Highlight the profile entry you want to delete.
2. Select File | Delete Security Profile.

Table 11-3: General, advanced, and Entrust profile properties

Property	Description	Comments/example
Name	The name you give to the security profile.
Description	A description of the security profile.
Use Entrust	Select this check box to use an Entrust ID instead of a certificate contained in the Sybase PKCS #11 token.	Selecting this check box prevents access to the certificates contained in the Sybase token.
Security Characteristic	Select a name from the drop-down list of predefined security characteristics to use for this profile.	See Table 11-2 for a description of security characteristics and the CipherSuites they support.
Description	A description of the selected security characteristic.	Each security characteristic comes with a description of its features.
Sybase PKCS #11 Token Certificate Label	From the drop-down list, enter the certificate label you want to use for this security profile. If you have not provided the PIN for the Sybase PKCS #11 token, you are prompted for one. This is the same PIN that you enter to access Security Manager.	If you are using an Entrust ID and click the Use Entrust check box, this property does not appear. See Chapter 12, "Managing Keys and Certificates" for more information on certificates.
SSL Cache Size	The number of entries in SSL session cache maintained by the server. The default cache size is 30.	These are advanced SSL parameters. They should be set only by someone who is knowledgeable about SSL. SSL reuses the previously negotiated security session parameters in a number of short-lived connections, which results in a relatively large performance gain over setting up completely new security sessions for each connection. When a security session is reused, clients avoid a CPU-intensive encryption of the premaster-secret using the server's public key. Similarly, servers avoid a CPU-intensive decryption of the premaster-secret using its private key. By configuring these parameters, you can control SSL caching on the server side.
SSL Session Share	The number of concurrent users (sessions) that can simultaneously use the same session entry (ID) in the session cache. The default session share size is 10.
SSL Session Linger	The duration for which a session entry is kept in the SSL session cache after the last SSL session using this session ID was closed. The default session linger value is eight hours.
Set Defaults	Select the Set Defaults check box to restore all of the advanced settings to their default levels.
Specify the Entrust INI File	Enter the complete path to the Entrust initialization file.	You can use the browse feature to locate this file. For example, on Windows NT, %SystemRoot%\entrust.ini.
Entrust User Profile	Enter the complete path to the Entrust user profile file.	You can also use the browse feature to locate this file. There is no default.
Entrust Password	The password to the Entrust login for this Entrust user profile.
Allow non-Entrust client	Click this check box to allow non-Entrust clients to connect to listeners that use an Entrust ID.

Copyright © 2002 Sybase, Inc. All rights reserved.