IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
IBM Tivoli Access Manager for e-business: WebSEAL Administration ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
You<br />
can<br />
specify<br />
whether<br />
to<br />
enable<br />
FIPS<br />
mode<br />
processing.<br />
FIPS<br />
mode<br />
processing<br />
is<br />
disabled<br />
by<br />
default.<br />
To<br />
enable<br />
it,<br />
set<br />
the<br />
following<br />
entry:<br />
[ssl]<br />
fips-mode-processing<br />
=<br />
yes<br />
Set<br />
this<br />
to<br />
yes<br />
when<br />
using<br />
ICC<br />
and<br />
wanting<br />
to<br />
use<br />
the<br />
FIPS<br />
140-1<br />
approved<br />
protocols<br />
and<br />
ciphers.<br />
Configuring<br />
<strong>WebSEAL</strong><br />
<strong>for</strong><br />
cryptographic<br />
hardware<br />
over<br />
BHAPI<br />
1.<br />
Install<br />
the<br />
device<br />
driver<br />
<strong>for</strong><br />
the<br />
specific<br />
cryptographic<br />
hardware<br />
you<br />
are<br />
using.<br />
2.<br />
GSKit<br />
(and<br />
there<strong>for</strong>e<br />
<strong>WebSEAL</strong>)<br />
detects<br />
the<br />
hardware<br />
and<br />
automatically<br />
uses<br />
it.<br />
If<br />
required,<br />
you<br />
can<br />
configure<br />
<strong>WebSEAL</strong><br />
to<br />
disable<br />
the<br />
automatic<br />
use<br />
of<br />
the<br />
hardware<br />
<strong>for</strong><br />
SSL<br />
acceleration<br />
over<br />
BHAPI.<br />
The<br />
disable-ncipher-bsafe<br />
and<br />
disable-rainbow-bsafe<br />
parameters<br />
are<br />
available<br />
in<br />
the<br />
[ssl]<br />
stanza<br />
of<br />
the<br />
<strong>WebSEAL</strong><br />
configuration<br />
file.<br />
By<br />
default,<br />
both<br />
parameters<br />
are<br />
set<br />
to<br />
″no″<br />
(that<br />
is,<br />
<strong>WebSEAL</strong><br />
automatically<br />
uses<br />
the<br />
hardware<br />
<strong>for</strong><br />
SSL<br />
acceleration<br />
over<br />
BHAPI).<br />
For<br />
example:<br />
[ssl]<br />
disable-ncipher-bsafe<br />
=<br />
no<br />
disable-rainbow-bsafe<br />
=<br />
no<br />
Configuring<br />
<strong>WebSEAL</strong><br />
<strong>for</strong><br />
cryptographic<br />
hardware<br />
over<br />
PKCS#11<br />
Install<br />
the<br />
cryptographic<br />
card<br />
and<br />
device<br />
driver<br />
Follow<br />
the<br />
instructions<br />
provided<br />
by<br />
the<br />
specific<br />
vendor<br />
to<br />
install<br />
the<br />
cryptographic<br />
card<br />
and<br />
its<br />
device<br />
driver<br />
(with<br />
PKCS#11)<br />
<strong>for</strong><br />
the<br />
specific<br />
cryptographic<br />
hardware<br />
you<br />
are<br />
using.<br />
This<br />
procedure<br />
involves<br />
shutting<br />
down<br />
and<br />
restarting<br />
the<br />
computer<br />
machine.<br />
Create<br />
a<br />
token<br />
device<br />
label<br />
and<br />
password<br />
to<br />
store<br />
<strong>WebSEAL</strong><br />
keys<br />
In<br />
the<br />
context<br />
of<br />
cryptographic<br />
hardware<br />
and<br />
the<br />
associated<br />
device<br />
drivers,<br />
a<br />
token<br />
is<br />
a<br />
logical<br />
device<br />
that<br />
acts<br />
as<br />
a<br />
″container″<br />
<strong>for</strong><br />
storing<br />
key,<br />
data,<br />
and<br />
certificate<br />
objects.<br />
Key<br />
objects<br />
can<br />
include<br />
public<br />
keys<br />
and<br />
private<br />
keys.<br />
When<br />
you<br />
configure<br />
a<br />
cryptographic<br />
card<br />
to<br />
per<strong>for</strong>m<br />
key<br />
storage<br />
(using<br />
the<br />
PKCS#11<br />
interface),<br />
you<br />
must<br />
define<br />
one<br />
or<br />
more<br />
tokens<br />
(or<br />
″containers″)<br />
that<br />
store<br />
keys<br />
<strong>for</strong><br />
different<br />
situations.<br />
When<br />
you<br />
configure<br />
a<br />
cryptographic<br />
card<br />
to<br />
per<strong>for</strong>m<br />
key<br />
storage<br />
tasks<br />
<strong>for</strong><br />
<strong>WebSEAL</strong><br />
(GSKit),<br />
you<br />
must<br />
specify<br />
a<br />
token<br />
label<br />
(and<br />
password)<br />
that<br />
represents<br />
the<br />
token<br />
device<br />
that<br />
stores<br />
the<br />
<strong>WebSEAL</strong><br />
public/private<br />
key<br />
pair.<br />
<strong>WebSEAL</strong><br />
sends<br />
the<br />
public<br />
key<br />
in<br />
the<br />
server-side<br />
certificate<br />
that<br />
it<br />
uses<br />
to<br />
authenticate<br />
itself<br />
to<br />
any<br />
client.<br />
Use<br />
the<br />
instructions<br />
provided<br />
with<br />
the<br />
installed<br />
cryptographic<br />
hardware<br />
to<br />
create<br />
a<br />
label<br />
<strong>for</strong><br />
the<br />
token<br />
device<br />
that<br />
stores<br />
the<br />
<strong>WebSEAL</strong><br />
key.<br />
For<br />
example:<br />
token<br />
=<br />
websealtoken<br />
password<br />
=<br />
secret<br />
Configure<br />
iKeyman<br />
to<br />
use<br />
the<br />
PKCS#11<br />
module<br />
(shared<br />
library)<br />
The<br />
GSKit<br />
iKeyman<br />
utility<br />
needs<br />
to<br />
be<br />
configured<br />
<strong>for</strong><br />
the<br />
PKCS#11<br />
device<br />
module<br />
(shared<br />
library)<br />
of<br />
the<br />
installed<br />
cryptographic<br />
hardware<br />
device.<br />
This<br />
module<br />
34<br />
<strong>IBM</strong><br />
<strong>Tivoli</strong><br />
<strong>Access</strong><br />
<strong>Manager</strong><br />
<strong>for</strong><br />
e-<strong>business</strong>:<br />
<strong>WebSEAL</strong><br />
<strong>Administration</strong><br />
Guide
Change language