Product Guide Revision 1.0. Version 7.5

Transcription

1 (%XVLQHVV6HUYHU ΠIRU]26DQG26 Product Guide Revision 1.0 Version 7.5

2 COPYRIGHT 2003 Networks Associates Technology, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of Networks Associates Technology, Inc., or its suppliers or affiliate companies. To obtain this permission, write to the attention of the Network Associates legal department at: 5000 Headquarters Drive, Plano, Texas 75024, or call TRADEMARK ATTRIBUTIONS Active Firewall, Active Security, Active Security (in Katakana), ActiveHelp, ActiveShield, AntiVirus Anyware and design, AVERT, Bomb Shelter, Certified Network Expert, Clean-Up, CleanUp Wizard, CNX, CNX Certification Certified Network Expert and design, Covert, Design (stylized N), Disk Minder, Distributed Sniffer System, Distributed Sniffer System (in Katakana), Dr Solomon s, Dr Solomon s label, Enterprise SecureCast, Enterprise SecureCast (in Katakana), epolicy Orchestrator, Event Orchestrator (in Katakana), EZ SetUp, First Aid, ForceField, GMT, GroupShield, GroupShield (in Katakana), Guard Dog, HelpDesk, HomeGuard, Hunter, LANGuru, LANGuru (in Katakana), M and design, Magic Solutions, Magic Solutions (in Katakana), Magic University, MagicSpy, MagicTree, McAfee, McAfee (in Katakana), McAfee and design, McAfee.com, MultiMedia Cloaking, Net Tools, Net Tools (in Katakana), NetCrypto, NetOctopus, NetScan, NetShield, NetStalker, Network Associates, Network Policy Orchestrator, NetXray, NotesGuard, npo, Nuts & Bolts, Oil Change, PC Medic, PCNotary, PortalShield, Powered by SpamAssassin, PrimeSupport, Recoverkey, Recoverkey International, Registry Wizard, Remote Desktop, ReportMagic, RingFence, Router PM, Safe & Sound, SalesMagic, SecureCast, Service Level Manager, ServiceMagic, SmartDesk, Sniffer, Sniffer (in Hangul), SpamKiller, SpamAssassin, Stalker, SupportMagic, ThreatScan, TIS, TMEG, Total Network Security, Total Network Visibility, Total Network Visibility (in Katakana), Total Service Desk, Total Virus Defense, Trusted Mail, UnInstaller, Virex, Virus Forum, ViruScan, VirusScan, WebScan, WebShield, WebShield (in Katakana), WebSniffer, WebStalker, WebWall, Who s Watching Your Network, WinGauge, Your E-Business Defender, ZAC 2000, Zip Manager are registered trademarks or trademarks of Network Associates, Inc. and/or its affiliates in the US and/or other countries. Sniffer brand products are made only by Network Associates, Inc. All other registered and unregistered trademarks in this document are the sole property of their respective owners. This product includes or may include software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( This product includes or may include cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes or may include some software programs that are licensed (or sublicensed) to the user under the GNU General Public License (GPL) or other similar Free Software licenses which, among other rights, permit the user to copy, modify and redistribute certain programs, or portions thereof, and have access to the source code. The GPL requires that for any software covered under the GPL which is distributed to someone in an executable binary format, that the source code also be made available to those users. For any such software covered under the GPL, the source code is made available on this CD. If any Free Software licenses require that Network Associates provide rights to use, copy or modify a software program that are broader than the rights granted in this agreement, then such rights shall take precedence over the rights and restrictions herein. LICENSE AGREEMENT NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANIES YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEB SITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO NETWORK ASSOCIATES OR THE PLACE OF PURCHASE FOR A FULL REFUND. Issued April 2003 / E-Business Server software version 7.5 for z/os and OS/390 DBN-004-EN

3 Contents Preface Audience Conventions Getting information Contacting McAfee Security & Network Associates Section 1 Using E-Business Server 1 E-Business Server Basics What can E-Business Server do for you? Key concepts Basic steps for using E-Business Server Getting Started Setting up E-Business Server Setting the location of files MVS/TSO environment USS environment Using the PGPPATH variable Default file locations USS environment Starting E-Business Server MVS/TSO environment USS environment Checking the version you have installed Command syntax Entering long options on the command line MVS/TSO environment USS environment Entering legacy options on the command line MVS/TSO environment Product Guide iii

4 Contents USS environment Entering configuration parameters on the command line Specifying keys using the user ID Specifying keys using the key ID Getting help while you work Cancelling an operation Creating and Exchanging Keys Choosing a key type Creating a key pair To create a key pair Creating subkeys To create an encryption subkey Creating a passphrase that you will remember Working with public and private keyrings Changing the location or names of your keyrings Backing up your keys Protecting your keys What if I forget my passphrase or lose my key? What is E-Business Server key reconstruction? To send your key to your company s key reconstruction server Exchanging keys with others Exporting (copying) your key to a file Exporting with your secret key Exporting in a format you can Exporting multiple keys Adding a key to your keyring To add a key to your keyring Exchanging keys using a key server Adding your key to a key server Removing your key from a key server Searching for a key on a key server Getting someone s public key from a key server Key Management Operations Managing your keyring Viewing your keys Viewing keys on another keyring (USS-only) iv E-Business Server <Superscript> software version 7.5 for z/os and OS/390

5 Contents Displaying all user IDs associated with each key Displaying all signatures associated with each key Getting more information about keys Getting more information about signatures on a key Removing keys from your keyring Removing a public key from your keyring To remove someone s public key from your keyring Removing a key pair from your keyring To remove a key pair from your keyring Verifying the contents of your public keyring Updating keys on your keyring Editing your key Adding and removing user IDs To add a new user ID To remove a user ID Setting your primary user ID To set your default user ID Changing your passphrase To change your passphrase Editing trust options for your key To edit trust options for your key Removing a signature from a key To remove selected signatures from a user ID on a key Adding a designated revoker to your key To add a designated revoker to your key Adding and removing photo IDs To add a photo ID to your key To remove a photo ID from your key To extract a photo ID to a file Revoking a key To revoke a key Disabling and enabling a key To disable a key To enable a key Splitting and rejoining a key Creating a split key To create a split key Reconstituting a split key Product Guide v

6 Contents Reconstituting a split key locally To join a key locally Reconstituting a split key over the network To join a key over the network: Additional Decryption Keys Recover data in an emergency Data recovery versus key recovery Types of ADKs Additional Decryption Key policy Protecting your Additional Decryption Key Implementing your Additional Decryption Keys Deleting your key from a key server To delete your key from a key server Reconstructing your key To reconstruct your key from your company s reconstruction server Working with Digital Signatures and Validation Signing information Producing a clear-signed message Signing with a specific private key Signing and encrypting Signing and encrypting a plaintext EBCDIC text file Creating a detached signature Verifying a digital signature Verifying a detached signature Storing signed files: signing a file without encrypting Validity and trust Checking a key s validity Viewing signatures on a key Getting more information about signatures on a key Viewing a key s fingerprint Granting trust for key validations Changing your trust settings on a key Signing a key To sign a key: Specifying the type of signature you want to add to a key Adding an expiration date to your signature Removing signatures from your key vi E-Business Server <Superscript> software version 7.5 for z/os and OS/390

7 Contents 6 Working with X.509 Certificates Common X.509 options Specifying a certificate with the issuer s name and serial number Specifying certificate attributes Adding an X.509 certificate to your key or keyring Getting an X.509 certificate from a CA Automatically requesting and adding an X.509 certificate to your key Retrieving and adding the Root CA certificate to your keyring To retrieve and add the Root CA certificate to your keyring Specifying CA parameters in the configuration file Automatically requesting a certificate from the CA To request a certificate Retrieve your certificate and add it to your key pair To retrieve your certificate Manually requesting and adding an X.509 certificate to your key Creating a PKCS #10 certificate request To create a PKCS #10 certificate request Sending your certificate request to the CA Manually retrieve your certificate and add it to your key pair To retrieve your certificate and add it to your key pair Exporting an X.509 certificate from your key To export an X.509 certificate Issuing X.509 certificates Create a new key for issuing X.509 certificates Create a Root CA certificate To create a root certificate Sign public keys with the root certificate To create an X.509 certificate Updating X.509 certificates on your keyring Encrypting and Decrypting Information Exchanging encrypted information Getting the recipient s public key Encrypting information Encrypting with conventional encryption Encrypting with public key encryption Encrypting into ASCII-armored format Product Guide vii

8 Contents Encrypting a text file Encrypting and specifying the output file Encrypting to multiple recipients Encrypting multiple files to one recipient Encrypting information to a group Automatically encrypting to your own key Encrypting for viewing by recipient only Encrypting and signing Encrypting and wiping the original plaintext file Creating Self-Decrypting Archives (SDAs) Creating PGParchives Decrypting information Viewing the decrypted file Viewing decrypted plaintext output on your screen Renaming the decrypted plaintext output file Recovering the original plaintext filename Decrypting SDAs and PGParchives Advanced Topics Using scripts with E-Business Server Using E-Business Server without interaction Understanding E-Business Server exit status codes Using E-Business Server as a UNIX-style filter Working with EBCDIC and binary data Encrypting and transmitting binary data Sending binary data files in ASCII-armored format without encryption or signature 103 Decrypting ASCII-armored messages Sending a public key in ASCII-armored format Sending EBCDIC text files to different machine environments Wiping your disk Wiping a sensitive data file Alternative ways to work with passphrases (USS-only) Specifying a file descriptor number PGPPASSFD PASSPHRASE-FD CONVENTIONAL-PASSPHRASE-FD CHALLENGE-FD Storing your passphrase with PGPPASS viii E-Business Server <Superscript> software version 7.5 for z/os and OS/390

9 Contents Passing your passphrase from another application Working with groups Creating a group Add recipients to a group Viewing a group Remove recipients from a group Removing an entire group Using JCL with E-Business Server Enabling Dynamic Dataset Allocation Pre-allocating temporary files Multi-volume files Using JCL with E-Business Server Key viewing JCL Key extraction JCL Encryption JCL Decryption JCL Understanding E-Business Server exit status codes Using REXX with E-Business Server Preparing to use REXX with E-Business Server Using the REXX interface for E-Business Server The Configuration File Learning about the configuration file MVS USS Specifying configuration values Setting configuration parameters from the command line Configuration parameters Section 2 Appendices and Index A Primary Command Line Options Conventions used in this section Primary command line options Product Guide ix

10 Contents B Command Line Options A quick reference of E-Business Server options Key options and file options Keyserver options Group options Help options C Compatibility with Previous Releases Legacy compatibility Configuration files Configuration settings Using +OPTIONS on the command line D Understanding a Key List Display Key list displays Example of --key-list option Example of --key-list --with-userids option Example of --key-list --with-sigs option Understanding the key list display Algorithm (Alg) Type Size Flags Key ID User ID E Supported Certificate Attributes General X.509 certificate attributes F Using Hardware Crypto Enabling the CSF address space Overview Configuring E-Business Server Performance levels with crypto hardware (ICSF) Example: Encrypting a text file x E-Business Server <Superscript> software version 7.5 for z/os and OS/390

11 Contents Example: Encrypting a binary file G Exit and Error Codes General errors Keyring errors Encode errors Decode errors Split key errors File errors Smart card errors Group errors Key reconstruction errors Key errors Key server errors Key update errors H Attaching a Regular Expression to a Signature Attaching a regular expression to a signature Definitions of the regular expression syntax used in E-Business Server I Biometric Word Lists Biometric Word Lists Index Product Guide xi

12 Contents xii E-Business Server <Superscript> software version 7.5 for z/os and OS/390

13 Preface This guide introduces McAfee E-Business Server software version 7.5 for z/os and OS/390, and provides the following information: Detailed instructions for installing the software. Overview of the product. Descriptions of product features. Descriptions of all new features in this release of the software. Detailed instructions for configuring and deploying the software. Procedures for performing tasks. Troubleshooting information. Glossary of terms. Audience This information is designed for system and network administrators who are responsible for their company s anti-virus and security program. This information is designed for people with some responsibility for configuring and using the software on their own workstations. This information is intended primarily for two audiences: Network administrators who are responsible for their company s anti-virus and security program. Users who are responsible for updating virus definition (DAT) files on their workstation, or configuring the software s detection options. This information is designed for programmers who write their own applications that use the McAfee Security scanning engine. Product Guide 3

14 Preface Conventions This guide uses the following conventions: Bold All words from the user interface, including options, menus, buttons, and dialog box names. Example Type the User name and Password of the desired account. Courier Text that represents something the user types exactly; for example, a command at the system prompt. Example To enable the agent, run this command line on the client computer: FRMINST.EXE /INSTALL=AGENT /SITEINFO=C:\TEMP\SITELIST.XML Italic Names of product manuals and topics (headings) within the manuals; emphasis; introducing a new term. Example Refer to the VirusScan Enterprise Product Guide for more information. <TERM> Angle brackets enclose a generic term. Example In the console tree under epolicy Orchestrator, right-click <SERVER>. NOTE WARNING Supplemental information; for example, an alternate method of executing the same command. Important advice to protect a user, computer system, enterprise, software installation, or data. 4 E-Business Server software version 7.5 for z/os and OS/390

15 Getting information Getting information Installation Guide * System requirements and instructions for installing and starting the software. E-Business Server 7.5 for z/os and OS/390 Installation Guide Product Guide * Product introduction and features, detailed instructions for configuring the software, information on deployment, recurring tasks, and operating procedures. E-Business Server 7.5 for z/os and OS/390 Product Guide Release Notes README.TXT. Product information, resolved issues, any known issues, and last-minute additions or changes to the product or its documentation. * An Adobe Acrobat.PDF file on the product CD or the McAfee Security download site. A printed manual that accompanies the product CD. Text files included with the software application and on the product CD. Product Guide 5

16 Preface Contacting McAfee Security & Network Associates Technical Support Home Page KnowledgeBase Search PrimeSupport Service Portal * McAfee Beta Program AVERT Anti-Virus Emergency Response Team Home Page Virus Information Library Submit a Sample Download Site Home Page DAT File and Engine Updates Product Upgrades * Training On-Site Training McAfee Security University Network Associates Customer Service Web US, Canada, and Latin America toll-free: ftp://ftp.nai.com/pub/antivirus/datfiles/4.x services_corporate_division@nai.com Phone VIRUS NO or Monday Friday, 8 a.m. 8 p.m., Central Time For additional information on contacting Network Associates and McAfee Security including toll-free numbers for other geographic areas see the Contact file that accompanies this product release. * Login credentials required. 6 E-Business Server software version 7.5 for z/os and OS/390

17 SECTION 1 Using E-Business Server E-Business Server Basics Getting Started Creating and Exchanging Keys Key Management Operations Working with Digital Signatures and Validation Working with X.509 Certificates Encrypting and Decrypting Information Advanced Topics Using JCL with E-Business Server The Configuration File

18

19 E-Business Server Basics 1 Welcome to E-Business Server for OS/390, a member of the McAfee product family. McAfee security products bring easy-to-use, strong encryption and authentication services to your enterprise across a broad range of platforms and applications. With E-Business Server, you can protect your data by encrypting it so that only intended co-workers and business partners can read it. You can also digitally sign data, which ensures its authenticity and that it has not been altered along the way. What can E-Business Server do for you? This product was designed to seamlessly integrate into existing E-Business processes (or enable new ones) to protect your corporate information while in storage or transit. The product s flexible command line interface allows you to quickly integrate E-Business Server with automated processes and web-based applications. The following are examples how you can use this product to protect your E-Business processes: A company s Human Resources (HR) group uses E-Business Server to securely send employee records over the Internet to a benefits provider. Prior to sending the records, an automated process on one of the company s HR servers uses E-Business Server to encrypt the records to the public key corresponding to the company s benefits provider. After the data has been encrypted, the server automatically establishes a connection to the benefits provider and transfers the data. A separate process on the benefits provider s server detects the new files, decrypts them with E-Business Server, and sends them to their final destination. A graphics card manufacturer shares large, confidential engineering designs with a business partner who is going to manufacture several key components for the card. The manufacturer s server automatically transfers the designs on a nightly basis via FTP to the partner s server over a firewalled leased line connection between the two companies. By leveraging the benefits of E-Business Server, these companies can now safely transfer these files over the Internet. This results in the immediate cost savings of getting rid of the inter-company leased line. E-Business Server also provides Internet bandwidth savings because it automatically compresses data before it encrypts it. Instead of sending 50 MB CAD files over the leased line, now they can send 10 MB CAD files that are encrypted to their business partner s public key. Product Guide 9

20 E-Business Server Basics An Internet e-commerce site uses E-Business Server to protect all their customer demographic and credit card information as soon as they receive it. Using the command line interface, they easily integrate into their existing web server processes. Now all customer data is secured immediately. Even if a hacker could penetrate their firewall and compromise the web server this data resides on, the hacker would only be able to obtain meaningless encrypted data. Key concepts E-Business Server is based on a widely accepted and highly trusted public key encryption system, as shown in Figure 1-1 on page 10, in which two complementary keys, called a key pair, are used to maintain secure communications. One of the keys is designated as a private key to which only you have access and the other is a public key which you freely exchange with other E-Business Server users. Both your private and your public keys are stored in keyring files. As its name implies, only you have access to your private key, but in order to correspond with other E-Business Server users you need a copy of their public keys and they need a copy of yours. You use your private key to sign the messages and file attachments you send to others and to decrypt the messages and files they send to you. Conversely, you use the public keys of others to send them encrypted and to verify their digital signatures. public key private key encryption decryption plaintext ciphertext plaintext Figure 1-1. Public Key Cryptography For a comprehensive overview of public key encryption technology, refer to An Introduction to Cryptography, which is included with the product. 10 E-Business Server software version 7.5 for z/os and OS/390

21 Basic steps for using E-Business Server Basic steps for using E-Business Server This section takes a quick look at the procedures a user would normally follow in the course of using E-Business Server. For details concerning any of these procedures, refer to the appropriate chapters in this book. The order in which you perform the following tasks will vary. 1 Install E-Business Server on your OS/390 mainframe. You will find detailed installation instructions in an accompanying Installation Guide or ReadMe file. 2 Configure E-Business Server to meet your needs. You can configure E-Business Server to perform in a specific way. For example, you can specify what encryption and hash algorithms E-Business Server should use, tell E-Business Server to add a specific comment to everything you encrypt, always encrypt a copy of your data to your own key as well as your recipient s, set the level of skepticism E-Business Server should use in determining whether others keys are valid, and so on. You do this by setting values in the configuration files as described in The Configuration File on page Create a private and public key pair. To use E-Business Server, you need a key pair. A key pair, as described in the section Key concepts on page 10, is composed of a private key to which only you have access and a public key that you can copy and make freely available to everyone with whom you exchange information. You can create a new key pair any time after you have finished the E-Business Server installation procedure. For more information about creating a private and public key pair, refer to Creating a key pair on page 26. Product Guide 11

22 E-Business Server Basics 4 Exchange public keys with others (optional). NOTE If you are using the E-Business Server Point-2-Point product, then you are limited to exchanging public keys with just one other user. After you have created a key pair, you can begin corresponding with other E-Business Server users. You will need a copy of their public key and they will need yours. Your public key is just a block of text, so it s quite easy to trade keys with someone. You can include your public key in an message, copy it to a file, or post it on a public or corporate key server where anyone can get a copy when they need it. You can, of course, use some of the E-Business Server functionality without exchanging keys with others. However, to encrypt information to another person, you need his or her public key, and conversely, others will need your key if they wish to encrypt information to you. You can keep copies of others keys stored in your public keyring file. For more information about exchanging public keys, refer to and Exchanging keys with others on page Validate public keys. Validation is a tricky concept within E-Business Server, and you might want to read about it in more detail in the accompanying Introduction to Cryptography. Validation goes hand-in-hand with a concept called trust. In a nutshell, once you ve obtained a copy of someone s public key, you can tell E-Business Server how you feel about the key--whether or not you ve made sure that the key has not been tampered with and that it really belongs to the purported owner. You can also tell E-Business Server whether or not and to what degree you trust the owner of the key to make such checks on other keys. If you tell E-Business Server you trust the key s owner, then E-Business Server will consider valid any keys the trusted person validates. Persons you trust are called trusted introducers. To validate a key, you compare the unique fingerprint on your copy of someone s public key to the fingerprint on that person s original key. If it checks out, you can then digitally sign the valid key (using your own private key) to tell others (and E-Business Server) that you consider it valid. To trust a key s owner (not the key, the owner), you set trust values in E-Business Server. Your Corporate Security Officer can act as a trusted introducer, and you may then consider any keys signed by the corporate key to be valid keys. If you work for a large company with several locations, you may have regional introducers, and your Security Officer may be a meta-introducer, which is a trusted introducer of trusted introducers. 12 E-Business Server software version 7.5 for z/os and OS/390

23 Basic steps for using E-Business Server For more information checking validation and setting trust, see Validity and trust on page Encrypt and sign your files. After you have generated your key pair and have exchanged public keys, you can begin encrypting and digitally signing files. For more information on encryption, see Encrypting information on page 85. For more information on digital signatures, see Signing information on page Decrypt and verify your files. When someone sends you encrypted data, you can decrypt the contents and verify any appended signature to make sure that the data originated with the alleged sender and that it has not been altered. For more information on decryption, see Decrypting information on page 93. For more information on verifying digital signatures, see Verifying a digital signature on page Wipe files. When you need to permanently delete a file, you can use the wipe command to ensure that the file is unrecoverable. The file is immediately overwritten so that it cannot be retrieved using disk recovery software. For more information on wiping files, see Wiping your disk on page 105. Product Guide 13

24 E-Business Server Basics 14 E-Business Server software version 7.5 for z/os and OS/390

25 Getting Started 2 Setting up E-Business Server This chapter describes where the E-Business Server files are located on your machine. It also explains how to start E-Business Server and enter information on the command line. Setting the location of files E-Business Server needs to know where the following files are located: MVS/TSO environment The E-Business Server files are allocated during the installation process. During installation, a high level qualifier (HLQ) can be chosen, and the datasets PUBRING, SECRING, RANDSEED, CONFIG and PGPGROUP will be prefixed by that HLQ. For instance, if the HLQ JOE.PGP is chosen during the installation, the configuration dataset will be named JOE.PGP.CONFIG. Your keyring files. E-Business Server stores your keypair in two files; the public portion is stored in the pubring and the private portion in the secring. If you add another user s public key to your keyring, it is stored in the public portion of the keyring. The random number seed file. E-Business Server uses the data in the random seed file (randseed) when it generates session keys. It is populated during the key generation process. (See An Introduction to Cryptography for more information on the role of session keys in E-Business Server.) The configuration file. E-Business Server stores a number of user-defined parameters in the configuration text file config. A configuration file enables you to define flags and parameters for E-Business Server, eliminating the need to define these parameters at the command line. The config file is not populated unless you add something to it. The groups file. E-Business Server stores any groups you create in the file pgpgroup. Groups are like distribution lists you use groups to create a list of recipients for your encrypted information. Encrypting information to the group encrypts the information to every key in the group in one operation. The file is not populated unless you add something to it. Product Guide 15

26 Getting Started USS environment Your keyring files. E-Business Server stores your key pair in two files: the public portion is stored in pubring.pkr and the private portion in secring.skr. If you add another user s public key to your keyring, it is stored in the public portion of the keyring. The files are created when you run E-Business Server for the first time. Specify the path to your keyring files using the PUBRING (see PUBRING (USS-only) on page 155) and SECRING (see SECRING (USS-only) on page 157) parameters in the configuration file. The random number seed file. E-Business Server uses the data in the random seed file (randseed.rnd) when it generates session keys. randseed.rnd is created when you run E-Business Server for the first time. Specify the path to the randseed file using the RANDSEED parameter (see RANDSEED (USS-only) on page 156) in the configuration file. (See An Introduction to Cryptography for more information on the role of session keys when using E-Business Server.) The groups file. E-Business Server stores any groups you create in the file pgpgroup.pgr. Groups are like distribution lists you use groups to create a list of recipients for your encrypted information. Encrypting information to the group encrypts the information to every key in the group in one operation. pgpgroup.pgr is created when you run E-Business Server for the first time. Specify the path to the groups file using the GROUPSFILE parameter (see GROUPSFILE on page 147) in the configuration file. The configuration file. E-Business Server stores a number of user-defined parameters in the configuration text file pgp.cfg. A configuration file enables you to define flags and parameters for E-Business Server, eliminating the need to define these parameters at the command line. The configuration file is created when you run E-Business Server for the first time. You can specify the path to the configuration file using the environment variable PGPPATH (see Using the PGPPATH variable on page 17). 16 E-Business Server software version 7.5 for z/os and OS/390

27 Setting up E-Business Server Using the PGPPATH variable PGPPATH is an environment variable that identifies the location of the configuration file. Syntax export PGPPATH=<PGPpathname> For example: export PGPPATH=/usr/local/pgp Alternatively, you can specify the location of the configuration file using --pgppath on the command line. This option is especially useful to CGI developers who can t set environment variables. Default file locations USS environment The first time you start E-Business Server, the software checks to see if PGPPATH is set to a particular pathname. If PGPPATH is defined, the software looks for the configuration file (pgp.cfg) in the directory specified by PGPPATH. If pgp.cfg does not exist in the directory specified, E-Business Server creates it using /usr/local/pgp/pgp-template.cfg or a pgp-template.cfg file in the same location as the E-Business Server executable. If PGPPATH is not defined, the software looks for pgp.cfg in the user s home directory, as defined by the environment variable HOME. If pgp.cfg does not exist, E-Business Server creates the.pgp directory within the home directory and creates the pgp.cfg file within.pgp. E-Business Server then places the keyring files, the randseed file, and the group file in the.pgp directory off your home directory (HOME/.pgp) after you run E-Business Server for the first time. As the administrator of E-Business Server, you can use multiple configuration files for flexibility in configuration. You can set default options in a system preferences configuration file, /usr/local/pgp/pgp.cfg. If this file exists, the default settings in this file are used unless overridden by settings specified in the other configuration files. E-Business Server checks for the existence of /usr/local/pgp/pgp-policy.cfg. If this file is present, E-Business Server reads this configuration file after parsing the normal configuration file and command line options. The settings in the pgp-policy.cfg override most settings in the normal configuration file, pgp.cfg. The only parameters that the pgp-policy.cfg file cannot override are the following parameters PUBRING, SECRING, RANDSEED, MYNAME, DEFAULT-KEY and ALIAS. Product Guide 17

28 Getting Started Starting E-Business Server MVS/TSO environment Type the following at the command line: exec xxx.samplib (pgptso) xxx represents the HLQ (high-level qualifier) you specified during installation. This invokes E-Business Server. The command line prompt displays. 18 E-Business Server software version 7.5 for z/os and OS/390

29 Checking the version you have installed USS environment NOTE Before you can use E-Business Server under USS, you may need to add the installation directory to your PATH using the PATH variable. The command line is available at all times. To use it, type pgp and then the command option for the operation you want to perform. You do not need to specifically start or end the program. pgp <option> The following text appears: McAfee E-Business Server Version #.# (c) Network Associates, Inc. All Rights Reserved. Help for basic operations. Use "--help" with the following options for individual usage. --armor --decrypt --encrypt --help --key-edit --key-export --key-gen --key-list --key-sign --list-aliases --sign --version --wipe Encode a file with base-64 encoding, with optional compression Decrypt data that was previously encrypted Encryption Display help for E-Business Server Specifies a keypair to be updated Exports a key from the keyring Generate a new keypair Display keys on the keyring Sign a key Show the active aliases Perform a cryptographic signature on input data Displays version information about the E-Business Server executable Performs a secure deletion of files For help on key management operations: For help on key editing operations: For help on keyserver operations: For help on group operations: For help on X.509 operations: pgp --help --key pgp --help --key-edit pgp --help --keyserver pgp --help --group pgp --help --x509 Checking the version you have installed Use the following syntax: pgp --version The following information appears: Product Guide 19

30 Getting Started McAfee E-Business Server Version #.# (c) Network Associates, Inc. All Rights Reserved. Product Name: McAfee E-Business Server Product Mode: Full Version : #.# Full Version: #.#.# Build Stage : Release Build Number: # Debug Info : Not present Command syntax In versions of E-Business Server prior to 7.1.0, command line options were typically one or two letters (for example, -kg was used for key generation). This older format is now known as legacy mode. In current versions of E-Business Server, the command line options are longer and more descriptive of the operation (for example, --key-gen is used for key generation). These newer options are known as long options. 20 E-Business Server software version 7.5 for z/os and OS/390