## NTP symmetric key and autokey authentication 

With symmetric key and autokey authentication, the highest level of NTP security is available. HMC Level 2.12.0 and later provide windows that accept and generate key information to be configured into the HMC NTP configuration. They can also issue NTP commands. 

The HMC offers the following symmetric key and autokey authentication and NTP commands: 

GLYPH<SM590000> Symmetric key (NTP V3-V4) authentication 

Symmetric key authentication is described in RFC 1305, which was made available in NTP Version 3. Symmetric key encryption uses the same key for encryption and decryption. Users that are exchanging data keep this key to themselves. Messages encrypted with a secret key can be decrypted only with the same secret key. Symmetric key authentication supports network address translation (NAT). 

GLYPH<SM590000> Symmetric key autokey (NTP V4) authentication 

This autokey uses public key cryptography, as described in RFC 5906, which was made available in NTP Version 4. You can generate keys for the HMC NTP by clicking Generate Local Host Key  in the Autokey Configuration window. This option issues the ntp-keygen command to generate the specific key and certificate for this system. Autokey authentication is not available with the NAT firewall. 

GLYPH<SM590000> Issue NTP commands 

NTP command support is added to display the status of remote NTP servers and the current NTP server (HMC). 

For more information about planning and setup for STP and NTP, see the following publications: 

## 10.5.10 Security and user ID management 

GLYPH<SM590000> Server Time Protocol Planning Guide , SG24-7280 

GLYPH<SM590000> Server Time Protocol Implementation Guide , SG24-7281 

GLYPH<SM590000> Server Time Protocol Recovery Guide,  SG24-7380 

This section addresses security and user ID management considerations. 

## HMC and SE HD encryption 

On z15 (continued emphasis on encryption): 

GLYPH<SM590000> Password is never stored in clear (one-way hash) 

GLYPH<SM590000> HMC/SE is a closed appliance; no means exist to get HDD 

GLYPH<SM590000> All  network traffic is TLS encrypted 

GLYPH<SM590000> HMC/SE features embedded firewall 

GLYPH<SM590000> Firmware is digitally signed and validated for delivery 

GLYPH<SM590000> Firmware Integrity Monitoring is used for any attempted tempering post delivery 

For HMC/SE Version 2.15.0, HDD encryption uses Trusted Platform Module (TPM) and Linux Unified Key Setup (LUKS) technology. 

## HMC and SE security audit improvements 

With the Audit and Log Management task, audit reports can be generated, viewed, saved, and offloaded. The Customize Scheduled Operations task allows you to schedule audit report generation, saving, and offloading. The Monitor System Events task allows Security Logs to send email notifications by using the same type of filters and rules that are used for hardware and operating system messages. 

