RE: TLSV1.x Usage in anticipation of v7.4

EUREKA!

It was a Telnet session that was using TLSV1.0. Adding the TLSCONFIG -netsecureTelnetServer:enabled picked up the transactions!

Now to find the user...

--Paul E Musselman

.


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Musselman Paul via MIDRANGE-L
Sent: Thursday, July 14, 2022 4:18 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Cc: Musselman Paul <Paul.Musselman@xxxxxxxxxxxxxxxxx>
Subject: RE: TLSV1.x Usage in anticipation of v7.4

Rob--

Thanks for your ideas.

I've tried searching the logs for a variety of things, including SSL and 1.0; no luck.

And I've been watching the connection counts and scanning the QAUDJRN around the time when a 1.0 connection was counted.

I just discovered the TLSCONFIG macro, so I've added

Option -netsecureTelnetServer:<enabled,disabled>
Determines if secure telnet handshakes should be audited
even if *NETTELSVR is not set in QAUDLVL or QAUDLVL2.
This field has no meaning if QAUDLVL or QAUDLVL2 does not
contain *NETSECURE. This field has no impact on what is
audited if QAUDLVL or QAUDLVL2 contains *NETTELSVR.

Option -display
SSL/TLS Connection Counters . . . . . : Enabled*
Netsecure Inspect Application Data . . : Allowed
Netsecure Telnet Server . . . . . . . : Enabled* < < < enabled

I'm waiting for a 1.0 connection to see if this adds more to the QAUDJRN.

--Paul E Musselman






-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob Berendt
Sent: Thursday, July 14, 2022 3:43 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: TLSV1.x Usage in anticipation of v7.4

Would TLS1.0 appear in those journal entries as TLS1.0? Or might it appear as something else? For example, might it have thought of TLS1.0 still as SSL3.0?
What is DTLS?
Would a search for 1.0 be successful?
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ibm.com%2Fdocs%2Fen%2Fi%2F7.3%3Ftopic%3Dentries-sk-sockets-connections-journal&amp;data=05%7C01%7CPaul.Musselman%40prysmiangroup.com%7Ccec300386323439bfc9a08da65d5f80b%7Ca5610c84ab8b4ad99ee6d3fe04264d43%7C0%7C0%7C637934266923301074%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=Zll8AVURNbDzr4jVqqg%2FnGIq%2Fbt2g7YpLnjA56kWZwE%3D&amp;reserved=0
Can you check at the time when a known TLS1.0 connection may have made?

Rob Berendt