WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Windows 2000 Professional and IBM Host Security

Windows 2000 Professional and SNA Server provide authentication, resource allocation, and data encryption services for maintaining a secure networking environment when you are integrating Windows 2000 Professional and IBM host systems.

Authentication

When you connect to an IBM host with Windows 2000 Professional and SNA Server, you can have single sign-on and password synchronization for authentication of access to resources on both your LAN host and on the IBM host. These services, which are provided with SNA Server, are integrated into the security features supported by Windows 2000 Professional and SNA Server. (For more information about security and Windows 2000 Professional, see the chapter "Security," in this book.)

Host Security Integration is the SNA Server feature that provides the single sign-on and password synchronization. Host Security Integration comprises the following three components:

Host Account Synchronization Service

Windows 2000 Account Synchronization Service

Host Account Cache

This service can be installed on primary, backup, or member computers that are running SNA Server within the SNA Server subdomain. You can also install the service on non-SNA Server-based computers. Host Account Synchronization Service supports third-party interfaces to various host security databases, which allows you to coordinate password changes between the Windows 2000 security domain and the host security domain.

You do not need to use Host Account Synchronization Service if you use the single-sign-on feature with manual password updates in which the administrator or users store host account information in the Host Account Cache through the Host Account Manager application (UDConfig). For more information about using the UDConfig tool, see the SNA Server version 4.0 Help and the Microsoft® BackOffice® Resource Kit.

Windows 2000 Account Synchronization Service

Windows 2000 Account Synchronization Service can automatically synchronize the passwords for your host accounts and Windows 2000 domain accounts. It must be installed even if automatic password synchronization is not going to be used because it also coordinates the internal operation of other services.

Windows 2000 Account Synchronization Service is installed on a Windows 2000-based domain controller. Only one instance of Windows 2000 Account Synchronization Service can be designated as primary; all other domain controllers on which the service is installed must be backup servers for this feature.

The capability of synchronizing passwords from the Windows 2000 domain to an AS/400 security domain is built into SNA Server. Third-party products also can provide enhanced synchronization services, such as two-way and automatic synchronization, to other host systems.

Host Account Cache

Host Account Cache maintains an encrypted database that maps host user accounts to Windows 2000 domain user accounts. Host Account Cache is a Windows 2000 service that is installed on Windows 2000 domain controllers. For smaller networks, SNA Server itself might be installed on a Windows 2000 domain controller and, therefore, could be used to store the Host Account Cache.

Optionally, a backup of Host Account Cache can be installed on another or the same Windows 2000 domain controller. The backup cache maintains a local copy of the user database that can be used for recovery if it's installed on another computer, or, if it's installed on the same computer as SNA Server, for eliminating network traffic for single-sign-on lookups.

NOTE

---

For detailed information about the Host Security Integration feature of SNA Server, see SNA Server Help.

Host Resource Allocation

In most cases, you probably have to control who can have access to SNA Server resources in your environment. The method you use to secure these resources depends on your host environment and the types of services you want to offer your users. Some of the SNA Server resources you can control access to are listed in the following sections.

3270 Terminal Access

Users or groups who require access to 3270 sessions from workstations using SNA Server Client applications must be members of the SNA Server subdomain. By virtue of their subdomain membership, users and groups are also members of the Windows 2000 domain of which the subdomain is a part. After you are enrolled in the SNA Server subdomain, you can assign specific 3270 (LU type 2) resources to the appropriate accounts. Users can have access only to the specific resources you allocate to them.

To maintain security in your environment, it is recommended that you use domain security to authenticate users and then limit their access by only assigning them specified resources.

5250 Terminal Access and APPC Access

Users who want APPC access do not have to be defined in the SNA Server subdomain, but they must be members of the Windows 2000 domain. For 5250 terminal access from a computer that is running SNA Server Client within the network, the AS/400 supplies the required logon security for access to the AS/400. For APPC access that is programmed into specific applications, security is maintained through the actual programmatic conversation.

TN3270 Service and TN5250 Service

TN3270 service and TN5250 service are secured by specifying client workstation IP addresses that have permission to use the specified resources. In the case of TN3270E clients, a workstation name can be specified in place of the client IP address. The method that is used to verify workstations can also be used to allow only specified IP addresses to request resources that are allocated to them.

Shared Folder Services

Access to AS/400 shared folders that are made available to Windows 2000 domain users through the Shared Folders Gateway Service can be controlled by specifying permissions for the resulting shared volumes and files. Permissions are set by using the standard Windows 2000 method for local shares.

NOTE

---

For detailed information about controlling resources on a server that is running SNA Server, see SNA Server Help.

Data Encryption

SNA Server allows you to encrypt data for client-to-server and server-to-server communication, as shown in Figure 26.7.

Figure 26.7 Model of Client-to-Server and Server-to-Server Data Encryption

Client-to-server encryption prevents information from being sent in plaintext between computers that are running SNA Server Client and computers that are running SNA Server. Data encryption enhances network security on the client-to-server communications path for all applications that are using SNA Server Client connections, including 3270/5250 emulators and APPC logon IDs and passwords. Data encryption can be enabled on a user-by-user basis with SNA Server Manager.

Server-to-server encryption can be used to provide secure communication across your network, the Internet, or any other WAN. If a user enables data encryption, information transferred through the Distributed Link Services is secure.