21
Sat, Dec
3 New Articles
  1. You are here:  
  2. Home
  3. Security
  4. IBM i (OS/400, i5/OS)
  5. Security Patrol: Security Questions & Answers

Security Patrol: Security Questions & Answers

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Q: I want to use DDM to access files on a remote system. Because the files contain sensitive information, they have been secured. The DDM job on the target system gets authorization failures for user profile QUSER. Is it possible to run the DDM job on the remote system with the QSECOFR user profile?

A: It is possible to configure your systems so that you can run DDM requests with a profile other than QUSER. Before I get into the configuration details, some background information is valuable so that you understand DDM security.

1 shows a typical DDM configuration. A program running on system A uses a DDM file to access the data from the PAY file on system B. The system that initiates the DDM request (system A) is called the SOURCE DDM system. The system that receives the request (system B) is called the TARGET DDM system. DDM starts a job on the target system to access the PAY file which is protected using standard AS/400 security.

Figure 1 shows a typical DDM configuration. A program running on system A uses a DDM file to access the data from the PAY file on system B. The system that initiates the DDM request (system A) is called the SOURCE DDM system. The system that receives the request (system B) is called the TARGET DDM system. DDM starts a job on the target system to access the PAY file which is protected using standard AS/400 security.

The communication configuration at the target system has a major role in the user profile used to access the data. The secure location attribute of the communication configuration at the TARGET system determines the user profile used to access the file. The two options follow:

1. If the communication configuration at the target system specifies SECURELOC(*NO), the DDM job at the target system runs using the default user specified in the communications entry of the communication subsystem. The default user is specified in the DFTUSR parameter of the Add Communications Entry (ADDCMNE) or Change Communications Entry (CHGCMNE) command.

2. If the communication configuration at the target system specifies SECURELOC(*YES), the DDM job at the target system runs using the same user profile that originated the request on the source system. Therefore, when SECURELOC(*YES) is used, the same user profile must be defined on both the SOURCE and TARGET systems.

See the next question in "Security Patrol" for information about the commands used to specify the secure location attribute.

The term SECURELOC confuses many users. A value of *YES does not mean that the communications transmission is secure. The opposite is true because the source system can start jobs on the target system by sending a user profile name and no password. The target system assumes the user was properly verified at the source system. The communication term for this support is "already verified." The source system has already verified the user and the target system agrees to accept a user profile name and no password to start a job.

As the administrator of system B, you should only specify SECURELOC(*YES) in the communication configuration when system A is part of your organization. You should be confident that good security practices are being used on the system. Do not specify SECURELOC(*YES) to systems outside your organization as this would allow people to run jobs as QSECOFR if they can sign on as QSECOFR on the other system.

Of the following methods to have jobs run as QSECOFR on system B, only the second method should be used.

1. Change the default user of the communications entry to a user profile that uses QSECOFR as its group profile. (You cannot explicitly specify QSECOFR as the default user of a communication entry.) This change would constitute poor security practice because every DDM request would run under QSECOFR. The default user is also used for the DDM Submit Remote Command (SBMRMTCMD) command that allows remote systems to run CL commands on the target system. Using a default user profile that uses QSECOFR as its group profile represents a serious security exposure.

2. Change the communication con-figuration to specify SECURELOC(*YES). The target system must have the same user profile as the source system. This is easy in the case of QSECOFR but now all DDM jobs for users other than QSECOFR on system A must have a matching user profile on system B.

Chapter 4 of IBM's Distributed Data Management Guide (SC41-9600) gives more details about the security of target-system DDM jobs.

Q: Where do you specify SECURELOC(*YES)?

A: SECURELOC can be specified two different ways based on the type of communication configuration.

1. The first method is used to specify the secure location value on an APPC device. This method can only be used when the device is not APPN-capable and the local address is not '00'. The Create Device Description (CRTDEVAPPC) or the Change Device Description (CHGDEVAPPC) command can be used to create or change these values. The SECURELOC parameter is shown in the following example:

 CRTDEVAPPC DEVD(T8189DEV2) + RMTLOCNAME(T8189NY) + ONLINE(*NO) + LCLLOCNAME(T8189LA) + CTL(T8189CTL) APPN(*NO) + SECURELOC(*YES) + TEXT('APPC Device + Description')

2. If the device is APPN-capable, APPN(*YES), and the local location address is '00', LOCADR(00), the secure location value is obtained from the APPN remote location configuration list.

To define or change a list of remote location entries for APPN, use the Create Configuration List (CRTCFGL) or the Change Configuration List (CHGCFGL) command. When the CRTCFGL or CHGCFGL command is used to define remote location names with a secure location value of *YES, the list type (TYPE) parameter must be *APPNRMT. For example:

 CRTCFGL TYPE(*APPNRMT) + APPNRMTE(*PROMPT)

The APPNRMTE(*PROMPT) parameter causes the system to prompt with the full- screen entry display shown in 2.

The APPNRMTE(*PROMPT) parameter causes the system to prompt with the full- screen entry display shown in Figure 2.

With a secure location value of *YES, I recommend the use of a second configuration parameter called LOCPWD (location password) for extra assurance that you are connecting with the proper system. A location password can be specified for an APPC device or through the remote location configuration list depending on where the secure location value is specified. The location password validates incoming SNA BIND commands for session establishment for both the local and remote locations. The password is a hexadecimal value with a maximum of 16 characters.

The location password and secure location values are ignored in a system with minimal (Level 10) security. For more information about APPN security, see the APPN Guide (SC41-8188).

Security Patrol: Security Questions & Answers

Figure 1 DDM Communications Example

 UNABLE TO REPRODUCE GRAPHIC 
 
 Security Patrol: Security Questions & Answers
 
 Figure 2 Create Configuration List Prompt
 
 Create Configuration List MCPGMR 07/25/94 11:52:49 Configuration list . . : QAPPNRMT Configuration list type : *APPNRMT Text . . . . . . . . . : *BLANK Type information, press Enter. --------------------------APPN Remote Locations--------------------------- Remote Remote Control Remote Network Local Control Point Location Secure Location ID Location Point Net ID Password Loc ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO ________ *NETATR *NETATR ________ *NETATR ________________ *NO More... F3=Exit F11=Display session information F12=Cancel F17=Top F18=Bottom
BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: