This article discusses new security features that you can look forward to when you upgrade to V5R3.

Single Sign-On

Since we've recently been discussing single sign-on in this column, I'll start with the additions that will make that endeavor even easier. The Network Authentication Services (NAS) configuration wizard, available through iSeries Navigator, has added very helpful configuration assistance when your Kerberos server is running on Windows. It also helps resolve some of the host name mismatch and capitalization issues that can frustrate even the best administrators when they are configuring single sign-on. In addition, if you prefer to avoid using a Microsoft platform, a Kerberos server is available to run on i5/OS in the PASE environment.

The Enterprise Identity Mapping (EIM) configuration wizard has been updated to include configuration of an EIM Domain Controller on a remote system. It also checks to see if NAS is configured on the system, and if it isn't, tells you it needs to be configured and provides the option to launch the NAS wizard.

One of the two new parameters on the Create and Change User Profile (CRT/CHGUSRPRF) commands--EIM Association (EIMASSOC)--allows you to add an EIM identity when creating or changing a user profile. This allows for easier EIM configuration going forward, but it also makes the initial configuration easier because it allows you to programmatically loop through all of the profiles on your system (using CHGUSRPRF) and add an identity, eliminating the need to do that part of single sign-on configuration by hand.

Additional enhancements include...

• The ability to map many identities to one user without having a source identity for each user
• EIM performance and stability enhancements
• The ability to use a digital certificate as a source for mapping to a user

Managing Passwords Through the iSeries for Integration Server

Local Password Management (LCLPWDMGT) is the other parameter added to CRTUSRPRF and CHGUSRPRF. It allows you to store OS/400 or i5/OS passwords on the integrated Windows server. This allows users to sign on to the integrated Windows server and have that password be used to sign on to OS/400 or i5/OS sessions. One must question whether you really want to store your OS/400 passwords on a Windows operating system, but the option is there if you want to use it.

User-Related Enhancements

If you have ever used PDM or set the experience level for working with message queues, you have used function that was only available to IBM products...until now. Function is now available for application developers to store "last used" data. In other words, the experience level or the last source file and library accessed or customized user-related data...you name it, it can now be stored. Not only can it be stored, but the advantage of using these system APIs to store this data (vs. the application managing this information itself) means that this data will be saved and restored right along with the user's profile. Check out the Update, Retrieve, and Remove User Application Information APIs documented in the Programming>APIs>APIs by Category>Security section of the V5R3 version of the Info Center.

I have mentioned using Application Administration several times. The problem with App Admin up until now is that to view all users' settings, you had to go through each user's profile using iSeries Navigator. There was no way to see the settings unless you wrote to the APIs (which is what I did in my product, SkyView Risk Assessor for OS/400 and i5/OS.) In V5R3, CL commands allow you to manage and display Application Administration settings so you no longer have to go through iSeries Navigator.

The QSYRUPWD and QSYSUPWD APIs have been enhanced to allow you to retrieve and set the encrypted Netserver password as well as the OS/400 or i5/OS password. (These APIs allow you to retrieve the encrypted user profile on one system and set it on another system. They are typically used to propagate passwords around a network of iSeries systems running OS/400 or i5/OS.)

If you have ever been frustrated by trying to find a particular user or group on the Display Object Authority or Edit Object Authority (DSP/EDTOBJAUT) commands, this enhancement should help: As of V5R3, the entries are alphabetized. Yippee!

File System Exit Points and System Values

The combination of two new system values and new exit points allow vendors to provide real-time virus scanning capabilities. Bytware has had a natively running virus-scanning product for several releases, but until now, they were limited to detecting the virus after it had been written to disk. In V5R3, they are taking advantage of new function to detect the virus before it is written to disk. The system value, QSCANFS works in conjunction with the exit points QIBM_QP0L_SCAN_OPEN (scan on open) and QIBM_QP0L_SCAN_CLOSE (scan on close) to determine what file systems are to be scanned and what program does the scanning. The QSCANFSCTL system value works in conjunction with new parameters on directory and stream file objects to determine which objects are scanned and when objects within a file system are scanned (for example, only scan when an object is modified) as well as the action to take when the scan fails.

Open Database File Exit Program API

A new exit point was added, QIBM_QDB_OPEN (Database File Open), which will allow much more flexibility in controlling access to a database file. This exit point returns to an exit program an indication of how the file is going to be opened, e.g., for read-only, read and insert, delete, etc. While I absolutely never recommend using exit programs as a substitute for object-level security, use of this exit point can add another layer of security to your security scheme. For example, you can determine whether it is a QZDSOINIT job, and if the file is being opened for query, allow the open. However, if the file is opened for update, not allow the transaction.

Auditing Enhancements

In addition to the single sign-on enhancements, this is my favorite enhancement in V5R3. Two of the possible values for the QAUDLVL system value, *SECURITY and *NETCMN, create a wide range of audit entries for their respective categories, many of which you probably don't care about under normal circumstances. These values have been broken down into subcategories. You can specify one or more of the subcategory settings and get just the selected audit entries or specify the original value and get all of the audit entries associated with that category.

These are the subcategories for *NETCMN:

• *NETBAS--Basic network events (SSL connections, APPN "firewall" activities)
• *NETCLU --Cluster resource groups
• *NETFAIL--Security-related network failures, e.g., secure socket port not available
• *NETSCK--Mail filtered, mail rejected, give and take socket descriptors

These are the subcategories for *SECURITY:

• *SECCFG--User profile, system value changes, network attributes, etc.
• *SECDIRSRV--Directory services
• *SECIPC--Interprocess communications
• *SECNAS--Network authentication ticket verification (Kerberos)
• *SECRUN--Runtime changes of object ownership, authorization list, etc
• *SECSCKD--Secure socket descriptors
• *SECVFY--Verification of profile handles and tokens
• *SECVLDL--Usage of validation list entries

I don't normally specify *NETCMN for the QAUDLVL system value, but I do recommend using the *SECURITY setting. However, it does produce more records that I really feel is necessary. So in V5R3, I recommend that you specify *SECRUN and *SECCFG instead of *SECURITY.

If you take the new possible settings along with the existing settings for QAUDLVL you will see that you can specify more values for QAUDLVL than it can contain. Therefore, a new system value, QAUDLVL2, was provided as an "overflow" value. For OS/400 or i5/OS to know it's supposed to examine the QAUDLVL2 system value, you must specify *AUDLVL2 in the QAUDLVL system value. If you don't, any values specified in QAUDLVL2 will be ignored.

Miscellaneous Enhancements

Here are some other enhancements in V5R3:

• The Retrieve Authorized Users to an Object (QSYRTVAU) API now includes pathname support.
• All commands found on the SECTOOLS menu can be run by a user that has only *AUDIT special authority. Prior to V5R3, the user needed at least *ALLOBJ and *SECADM special authorities to run the commands.
• Digital certificate APIs allow digital certificates to be stored in LDAP. In addition, digital certificate management APIs have been added to help manage certificate expiration.
• Numerous internal system integrity enhancements and enhancements to the Check Object Integrity (CHKOBJITG) command allow you to continue to have faith in the internal workings of the operating system and SLIC.
• New crypto APIs support encrypt, decrypt, hashing, RSA key generation, and Diffe-Hellman key exchange. Also, a FIPS-compliant JCE provider that will be available for both V5R2 and V5R3 is currently undergoing certification testing.
• Undergoing the Common Criteria certification process: The Common Criteria is a replacement for the C2 certification of years past.

I hope you've enjoyed your "tour" of the V5R3 security enhancements and can take advantage of these enhancements--many of which will make your life much easier--very soon.

Carol Woodbury is co-founder of SkyView Partners, a firm specializing in security consulting, remediation services and security assessments, including the risk assessment product, SkyView Risk Assessor for OS/400 and i5/OS. Carol has over 13 years in the security industry, 10 of those working for IBM's Enterprise Server Group as the AS/400 Security Architect and Chief Engineering Manager of Security Technology. Look for Carol's second book, Experts' Guide to OS/400 and i5/OS Security.

Carol can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..