Changes to security

New options CHANGETIME, DAYSLEFT, EXPIRYTIME, INVALIDCOUNT, and LASTUSETIME reveal more information about the sign-on user ID and password.

• VERIFY PASSWORD
• VERIFY PHRASE
• VERIFY TOKEN

New option GROUPID on VERIFY PASSWORD and VERIFY PHRASE supports password or passphrase verification against the supplied group ID.

VERIFY TOKEN is enhanced to support JSON Web Tokens (JWTs) provided by RACF.

ON by default

New options EXIT and DISCONNECT on GMTRAN system initialization parameter allow you to control what happens if the user fails to complete the sign-on using CESN or CESL.

Option DISCONNECT on GMTRAN system initialization parameter also applies to CESF.

New option GMEXITOPT shows the GMTRAN terminal session behavior option on a PF3 or PF15.

CICS checks the region user ID's authority to access Category 1 transactions at startup. Message DFHXS1113 is issued for unauthorized transactions.

Authorization check for Category 1 transactions is removed. There's no need to define Category 1 transactions to RACF anymore.

To conform with a zero trust strategy, all CICS transactions, excluding CJXA and CICSPlex® SM transactions (CO**), are defined with CMDSEC(YES) and RESSEC(YES) to perform command and resource security checking.

For a list of affected CICS transactions, see CICS transactions subject to security checking.

To conform with a zero trust strategy, the default values of CMDSEC and RESSEC attributes are changed to YES for all newly defined TRANSACTION resources.

CICS surrogate user checking is made if system initialization parameter XUSER=YES is in effect.

The default job user ID for a JOB card that is submitted, without a USER parameter, by using SPOOL commands to the internal reader, is subject to the INTRDRJOBUSER system initialization parameter instead of a feature toggle that is now made obsolete. By the default of INTRDRJOBUSER, the task user ID is assumed while in 5.5 through 6.1 the CICS region user ID is assumed.

Command security checking is not performed if the task or program that issues the command was started or attached to the same terminal that is being inquired or modified by the command, with a few exceptions.

• Requires minimum z/OS® 2.4

The default is changed from TLS10 to TLS12.

• TLS13

Accepts more formats of key ring names to allow use of key rings that are not owned by the region user ID.

Accepts more formats of key ring names to allow use of key rings that are not owned by the region user ID.

Accepts more formats of key ring names to allow use of key rings that are not owned by the region user ID.

Accepts more formats of key ring names to allow use of key rings that are not owned by the region user ID.

The default is changed from SHOW to HIDE. The HIDE option replaces HIDETC.

Feature toggle com.ibm.cics.web.defaultcipherfile is available and applies to outbound HTTP requests using EXEC CICS WEB OPEN or EXEC CICS INVOKE SERVICE commands that do not specify CIPHERS or URIMAP.

Feature toggle com.ibm.cics.web.defaultcipherfile is available and applies to outbound HTTP requests using EXEC CICS WEB OPEN or EXEC CICS INVOKE SERVICE commands that do not specify CIPHERS or URIMAP.

Feature toggle com.ibm.cics.web.defaultcipherfile allows you to use ciphers from the default cipher suite specification file (defaultciphers.xml). It applies to outbound HTTP requests using EXEC CICS WEB OPEN or EXEC CICS INVOKE SERVICE commands that do not specify CIPHERS or URIMAP.

com.ibm.cics.web.defaultcipherfile is extended to apply to URIMAP resources with no ciphers specified.

• com.ibm.cics.web.defaultcipherfile is extended to apply to URIMAP resources with no ciphers specified.

• Cipher suites that use NULL, Triple DES (3DES) and RC4 encryption are removed from the sample default cipher suite specification file (defaultciphers.xml). See Changes to samples.

• New fields SOTLSLVL and SOFLAG in Performance data in group DFHSOCK.
• New fields MNR_URIMAP_TLSLVL and MNR_URIMAP_FLAG in Transaction resource class data: Listing of data fields.
• New message DFHXS1117 provides additional diagnostic information.
• New cipher resource statistics provide details of the ciphers that are used in inbound and outbound connections.
• TLS protocol level usage is available in the TCP/IP global statistics.

Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.

Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.

Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.

• Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.
• CICS uses a minimum key size of 256 for ECC keys and 2048 for RSA, DSA and Diffie-Hellman keys during TLS handshakes. SeeIncrease minimum key size for TLS connections

Sysplex caching for TLS 1.3 is supported. See SSLCACHE system initialization parameter.

• CHANGED: For a CICSPlex SM WUI server (CPSMCONN=WUI), TCPIPSSL is mandatory if security is active.
• CHANGED: For a CICS System Management Single Server (SMSS) defined with CPSMCONN=SMSSJ, CMCISSL is mandatory if security is active.

• CICS_CAT3_CONFIGURATION
• CICS_REGION_CONFIGURATION
• CICS_RESOURCE_CONFIGURATION
• CICS_RESOURCE_SECURITY
• CICS_USS_CONFIGURATION

When logging is disabled for QUERY SECURITY, CICS security domain statistics are still written to XSG_AUTHOR_FAIL_NL_NA and XSG_AUTHOR_FAIL_NL_NF fields, with DFHSTUP names Failed authorizations NOLOG NOTAUTH and Failed authorizations NOLOG NOTFND respectively.

When logging is disabled for QUERY SECURITY, CICS monitoring data is still written to XSNLNACT and XSNLNFCT fields.

Surrogate checking is always done. Specifying SURROGCHK=YES in the EXCI options table, DFHXCOPT, is accepted for compatibility.

Surrogate checking is always done. Specifying SURROGCHK=YES in the EXCI options table, DFHXCOPT, is accepted for compatibility.