Check Object Integrity (CHKOBJITG)

Did you know that, in V5R1, OS/400 is digitally signed? And to that I hear you say, "So what?" Well, OS/400 is the only operating system in the midrange market today that ensures its own integrity. Because OS/400 has been digitally signed before leaving IBM, you can use the CHKOBJITG command to ensure that OS/400 has not been tampered with since being installed on your system. It will also check certain attributes of user programs, commands, and other objects to ensure they have not been tampered with either. CHKOBJITG is, in essence, a virus scanner for OS/400.

You should run this command on a regular basis but, because it can be quite long-running, run it only when your system is the least busy (if such a time exists on your system!) or run it as a background job that uses the spare cycles of your CPU. The output is a file that contains a list of any objects that have been tampered with.

Display User Profile (DSPUSRPRF)

I can hear it now: What's not obvious about the DSPUSRPRF command? If you simply run the command to display the attributes of a specified user, it is obvious. But less obvious are all of the options you have for displaying specific information about a specific user. You can display the objects owned, objects authorized, commands authorized, and, my favorite, the members of a group profile. For example, running the following command will list all of the members of the Accounting Group (GRP_ACCTG):

Another aspect of DSPUSRPRF is the ability to send the requested information to an outfile. Run the following command to get all of the information about all users on the system:

With all of this in an outfile, you can slice and dice the information any way you want to discover many interesting things about the users on your system.

Print User Profile (PRTUSRPRF)

PRTUSRPRF is a variant of DSPUSRPRF except that it goes to a spooled file with no other output option. Also, it only shows information about all users on the system (unlike DSPUSRPRF, which allows you to specify *ALL, one, or a generic name range). With few exceptions, this report shows all of the security attributes of every user on the system in one report. The only attributes it does not show are the profiles with default passwords and the auditing attributes.

Outfiles Produced by the Security Tools

Although most people know about OS/400's security tools (reached by typing GO SECTOOLS on an OS/400 command line), many people don't know about the outfiles that many of the tools produce. These outfiles provide a wealth of information to query to produce your own reports or the exact combination of information that you find meaningful. Most, but not all, of the tools produce an outfile before the report associated with the tool is printed. To determine if a tool does create an outfile, type in the command name or take a menu option off the SECTOOLS menu. Put your cursor on the title line of the command and hit Help (F1). The text describes any outfiles that are created, along with the format used to produce the file.

Change Ownership (CHGOWN) and Change Authority (CHGAUT)

I am often asked, "How do I change the ownership of all of the objects in a library?" While it may not be obvious, the commands that help you manage authorities in the Integrated File System (IFS) can also help you manage OS/400 authorities. The CHGOWN command allows you to change the ownership of all of the objects in a library in one fell swoop. The following command allows you to change the ownership of all of the objects in the CJW_LIB library:

In the same way, the CHGAUT command allows you to change the authority of all the objects in a library. Running the following command changes the *PUBLIC authority of all of the files in the CJW_LIB library to the equivalent of *USE:

*PGMADP Auditing Value

OS/400 auditing is very powerful. One of my favorite auditing values is *PGMADP, which causes OS/400 to generate an audit journal entry when adopted authority is used to gain access to a resource (a file or library or directory, for example). When trying to track down how a certain "incident" occurred--for example, a very powerful user profile gets created or a program is created into production without going through change control--it is often useful to add this value to the QAUDLVL system value. These incidents often occur because users exploit adopted authority. If you suspect you know who performed the incident, you can use the Change User Auditing (CHGUSRAUD) command and turn on *PGMADP for this user or a set of users. I recommend turning this on at the user level if at all possible, since many applications use adopted authority for their security scheme. If you turn it on at the system level, you tend to get many entries besides the ones you are really looking for. Once you've turned on this level of auditing, you will want to regularly check the audit journal for AP entries. These audit journal entries provide you with the name of the program that adopts the authority and the profile whose authority was adopted and used to perform the task the user would not normally be authorized to perform. I have seen this feature used to catch programmers who were exploiting adopted authority to create powerful profiles that they could then use to perform other "interesting" tasks.

Web Site to Check CERT Advisories

We hear of security advisories coming out of CERT, and most of them have no effect on OS/400, but how can you be sure? Check out IBM's Resource Link Web site. You do have to register to get information from this site. And even after signing in, you still have to hunt a bit (this is truly a hidden jewel). The key is to click on "Problem solving" in the left nav bar. Then, under the Hardware heading, go to the subheading of Alerts and click on the link for Security alerts. One of the confusing parts of this Web site is that it appears to be a zSeries Web site. And it is. But IBM expanded the information available to include AIX, OS/400, and xSeries. The OS/400 information is provided by IBM Rochester personnel who have the knowledge and resources available to do the research and make an accurate determination as to whether OS/400 is affected by specific vulnerabilities. It's pretty cool. I recommend that you check it out.

Enterprise Identity Mapping

EIM is hidden, and that's really the way it's supposed to be. This "jewel" is a technology that is not a solution unto itself but a technology that enables really cool stuff, including single sign-on and user management tools. Another cool feature is that this technology is not limited to the iSeries. It has been integrated into the pSeries and zSeries as well. Combined with Kerberos, EIM provides the capability to have an enterprise-wide single sign-on implementation. Is that cool or what? A couple of vendors have already taken advantage of this technology and are providing products to aid you in managing the single sign-on environment. You can be certain that more vendors will be integrating this technology into their solutions in the future. In other words, watch this space!

Carol Woodbury is co-founder of SkyView Partners, a firm specializing in security consulting and services and offering the recently released software, SkyView Risk Assessor for OS/400. Carol has over 13 years in the security industry, 10 of those working for IBM's Enterprise Server Group as the AS/400 Security Architect and Chief Engineering Manager of Security Technology. Look for Carol's second book, Experts' Guide to OS/400 Security, to be released in May. Carol can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..