Configuring security profiles

Security profiles define the security characteristics of a client-EAServer session. You assign a security profile to a listener, which is a port that accepts client connection requests of various protocols. EAServer can support multiple listeners. Clients that support the same characteristics can communicate to EAServer via the port defined in the listener.

Each security profile has an associated security characteristic. A security characteristic is a name that has a set of cipher suites associated with it. A security characteristic, along with the cipher suites, defines these characteristics of a client/server connection:

• Protocol All profiles use SSL version 3 as the underlying protocol. IIOPS and HTTPS traffic is tunneled through SSL.

• Authentication Whether or not authentication is used. Profiles can support:

  • No authentication – neither client nor server need to provide a certificate for authentication.

  • Server authentication – only the server needs to provide a certificate to be accepted or rejected by the client.

  • Client and server authentication – both the client and server supply certificates to be accepted or rejected by the other.

• Encryption strength and method Whether or not data is encrypted, and if so, the key strength and method of the encryption.

• International use All cipher suites are available domestically, but not all are suitable for export outside of the United States and Canada.

• Hashing method The method used to create the message digest.

For example, the cipher suite SSL_RSA_WITH_NULL_MD5 can be interpreted as:

SSL – the protocol used. All profiles use SSL.

RSA – the key exchange algorithm used.

NULL – no encryption.

MD5 – the hash method used to compute the message digest.

Table 13-1 and Table 13-2 clarify the relationship between cipher suite terminology and security characteristics.

Security characteristics

There are four categories of security characteristics:

• Simple The predefined characteristics sybpks_simple and sybpks_simple_mutual_auth offer authentication but no encryption.

• Strong The predefined characteristics sybpks_strong and sybpks_strong_mutual_auth offer greater domestic encryption strength.

• Domestic All characteristics are suitable for domestic use. Clients using international cipher suites can connect to servers using domestic security characteristics.

• International Because of export regulations, only these characteristics are suitable for export:

  • sybpks_simple

  • sybpks_simple_mutual_auth

  • sybpks_intl

  • sybpks_intl_mutual_auth

Table 13-2 lists the name, the level of authentication, and the supported cipher suites for each security characteristic. Table 13-1 describes the cipher suites listed here.

Defining security profiles

This section describes how to create, modify, and delete a security profile. All of the configuration tasks require you to first access the Security Profiles folder. To do this, highlight the Security Profiles folder from EAServer Manager.

See Table 13-3 when creating, modifying, or deleting a security profile.

Creating a new security profile

1. Highlight the Security Profiles folder and choose File | New Security Profile. The Security Profile wizard displays.

2. Follow the wizard pages to configure the profile properties. For more information on these settings, click Help in the Wizard or see Table 13-3.

The new security profile now appears on the right side of the window when the Security Profiles folder on the left side of the window is highlighted.

Modifying an existing security profile

1. Highlight the security profile you wish to modify.

2. Choose File | Properties to display the Security Profile Properties dialog box with fields described in Table 13-3.

   Alternatively, choose File | Configuration Wizard to run the configuration wizard. For more information on the wizard settings, click Help in the Wizard or see Table 13-3.

Deleting a security profile

1. Highlight the profile entry you want to delete.

2. Select File | Delete Security Profile.

SSL session caching and reuse

For improved performance, EAServer caches SSL session identifiers and allows clients to reuse them. Since creating an SSL session requires CPU-intensive computations, SSL session reuse results in a relatively large performance gain over setting up completely new security sessions for each connection. The settings on the Advanced tab control how SSL clients can reuse sessions for subsequent and simultaneous connections.

Cached sessions allow the client to reuse a session in a subsequent connection. The SSL Cache Size setting controls how many entries can be cached. Set this to a number less than or equal to the maximum connections setting for the server. The cache requires approximately 64 bytes per entry. The SSL Session Linger value specifies how long cached session IDs remain valid.

The SSL Session Share setting specifies how many simultaneous connections can share one session ID. Session sharing can improve performance when the client opens multiple connections simultaneously. For example, a browser client may open several connections at once to download images linked to an HTML page. Session sharing allows the client to reuse the session for the second and subsequent connections, up to the number of concurrent connections specified by the SSL Session Share value.

Copyright © 2005. Sybase Inc. All rights reserved.