When TSM administrators sign onto the TSM server using the TSM administrative Web interface client, they provide a user ID and password. The TSM server generates a security token for this user ID, and this token is used to verify the TSM administrative Web interface each time it issues a command to the TSM server. The security token is encrypted, and expires after a certain period of time. When the TSM administrator, after signing onto the TSM server, hyperlinks to the Web backup-archive client, the security token is passed to the Web client and is used to authenticate the user ID. Since this token permits the user access to the client, the Web client provides the user the option to securely pass this information from the administrative Web interface to the Web client using the HTTPS protocol.
HTTPS is simply the HTTP protocol transmitted over a secure socket layer. If your TSM administrators are hyperlinking to client machines to use the Web client, and you need to protect the security token when it is transmitted over the network, then you should configure the Web client for SSL so that the HTTPS protocol can be used.
The following sections contain information that will help you manage SSL communications:
To support SSL, the TSM install package includes utilities to create and maintain certificates. SSL communication is only supported on AIX, AIX 5L, Windows 98, Windows Me, Windows NT, and Windows 2000. You can use the Make Key File utility (MKKFE) to create public-private key pairs and certificate requests, receive certificate requests into a key ring, and manage keys in a key ring. MKKFE prompts you for the necessary information. Optionally, after you have created a certificate request, you can send it to a Certificate Authority (CA) to have it signed.
This section describes the following tasks for setting up TSM to use SSL:
To create a public-private key pair, request a certificate, receive it into the key ring file, and:
To request a certificate:
To receive the certificate into the key ring:
After the certificate is created and received into the key ring file, copy the key ring file, certkey.kyr, to the TSM client installation directory. Before bringing up the TSM Client Acceptor, set the httpsport option. The httpsport option specifies the TCP/IP port address that is used by the HTTPS secure socket layer (SSL) interface to communicate with the Web client. See Httpsport for more information.
Set the NLSPATH environment variable as follows:
export NLSPATH=/usr/tivoli/tsm/client/ba/bin/%N:$NLSPATH
c:\program files\tivoli\tsm\baclient\%N
Start the TSM Client Acceptor using one of the following procedures:
The client starts the initialization of the SSL communication method.
You can access the TSM Web client using the SSL communication method with any browser that is Java1.1.6-capable by entering the following URL:
https://your_machine_name:httpsport_number
where your_machine_name is the hostname of the machine running the TSM Web client with the SSL communication method, and httpsport_number is the port number you specified using the httpsport option, see Httpsport for more information.
The Web client workstation can also be accessed through the TSM system administrative GUI.
You will receive warning messages from the Web browser the first time you connect to the client machine. This is because the certificate that you created is not trusted by the browser. Each browser handles the matter differently. Netscape permits you to receive the certificate as a Web site certificate. The received certificate is then compared with the certificate sent by the TSM client every time you connect to the server. After setup completes, you are not prompted for more information if you click the Always accept bullet in the wizard. Internet Explorer prompts you if the received certificate is not trusted. You will receive this message every time you connect to the TSM client, unless you turn the warning message off.