Enable Security Auditing in Dashboard Application Service Hub (DASH)

Question & Answer

Question

How can I track users who login to JazzSM/DASH along with their IP address and other information?

Cause

The security auditing has been introduced in DASH as a part of the security infrastructure. The primary responsibility of the security infrastructure is to prevent unauthorized access and usage of resources. Security auditing achieves these goals by providing the infrastructure that allows you to capture and store supported auditable security events. Each time a DASH application/end user accesses a secured resource or any internal application server process it can be recorded as an auditable event.

The security auditing has the ability to capture the following types of auditable events:
a. Authentication
b. Authorization

These types of events can be recorded into audit log files. Each audit log has the option to be signed and encrypted to ensure data integrity. These audit logs can be analyzed to discover breaches over the existing security mechanisms and to discover potential weaknesses in the current security infrastructure.

Answer

DASH provides a script “configureConsoleAudit.sh/.bat “ to enable audit capability in Websphere. By using this script you can enable or disable security auditing.

Usage:

configureConsoleAudit.sh smadmin password [true|false]

Where smadmin is userid which is DASH Administrator user, and password is the password for this user.
true/false : enable/disable audit feature.

Example;
cd <JazzSMHOME>/ui/bin
$ ./configureConsoleAudit.sh smadmin password true

Note : JazzSM server needs to be restarted after enabling/disabling the audit capability.

DASH Audit Log files

Websphere generates a Binary Audit log file, which contains the audit records for various actions that is performed in DASH. The log file is created in the following directory:

<JazzSMHOME>/profile/logs/server1

The log file is named as “BinaryAudit_JazzSMNode01Cell_JazzSMNode01_server1.log”. Binary Audit log file can be signed/encrypted for protection of audit data. Please refer to Websphere documentation in IBM Knowledge center for details on this :

Audit Record and Event Types

Following are Audit event types and audit Filters:

SECURITY_AUTHN : This event type represents the authentication flow:

For example : when an end user login, a SECURITY_AUTHN event type will be recorded in audit log files.

SECURITY_AUTHN_TERMINATE : This event type represents the logout action. For example : when a user logout from DASH console, an audit record is recorded.

SECURITY_MGMT_REGISTRY : The audit event represents the “authorization”. Various access control operations on DASH resources such as role management, page management, portlet management actions are all recorded as this event. Please see below sections on what actions are reported as this event type.

Note:

You may notice slow performance from DASH with above traces enabled. In that case please make a backup copy of below file and then manually enable the features you need and disable the remaining ones. Restart TIP after this change.

<JazzSMHOME>/profile/config/cells/JazzSMNode01Cell/audit.xml

[{"Product":{"code":"SSRLR8","label":"Tivoli Components"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Component":"Jazz for Service Management","Platform":[{"code":"PF002","label":"AIX"},{"code":"PF016","label":"Linux"},{"code":"PF025","label":"Platform Independent"},{"code":"PF027","label":"Solaris"},{"code":"PF033","label":"Windows"}],"Version":"1.1.1;1.1.1.1;1.1.2","Edition":"All Editions","Line of Business":{"code":"","label":""}}]

Tips

Enable Security Auditing in Dashboard Application Service Hub (DASH)

Question & Answer

Question

Cause

Answer

Was this topic helpful?

Document Information

UID

Share your feedback

Need support?