All passwords stored in PlateSpin Orchestrate are hashed using Secure Hash Alogrithm-1 (SHA-1). However, user passwords are no longer hashed when sent from the client to the server. Instead, the plain text password entered by the user is sent over an encrypted authentication connection to the server to obtain a unique per-session credential issued by the server. This allows the server to “plug in” to alternative user directories such as Active Directory or OpenLDAP. Agent credentials are still stored, singly hashed, on the disk on the agent machine. The first pass hashing prevents “user friendly” passwords entered by administrators from being compromised by storing them on the agent machines. The server’s password database (for agents and for users not using an alternative user directory) stores all passwords in a double-hashed form to prevent a stolen password database from being used to obtain passwords.
WARNING:The zosadmin command line and the PlateSpin Orchestrate Development Client do not use SSL encryption, nor do they support TLS/SSL, so they should only be used over a secure network.
All agent and client connections support TLS encryption. This includes the zos command line and the PlateSpin Orchestrate Agent.