This article discusses new security features that you can look forward to when you upgrade to V5R3.
Single Sign-On
Since we've recently been discussing single sign-on in this column, I'll start with the additions that will make that endeavor even easier. The Network Authentication Services (NAS) configuration wizard, available through iSeries Navigator, has added very helpful configuration assistance when your Kerberos server is running on Windows. It also helps resolve some of the host name mismatch and capitalization issues that can frustrate even the best administrators when they are configuring single sign-on. In addition, if you prefer to avoid using a Microsoft platform, a Kerberos server is available to run on i5/OS in the PASE environment.
The Enterprise Identity Mapping (EIM) configuration wizard has been updated to include configuration of an EIM Domain Controller on a remote system. It also checks to see if NAS is configured on the system, and if it isn't, tells you it needs to be configured and provides the option to launch the NAS wizard.
One of the two new parameters on the Create and Change User Profile (CRT/CHGUSRPRF) commands--EIM Association (EIMASSOC)--allows you to add an EIM identity when creating or changing a user profile. This allows for easier EIM configuration going forward, but it also makes the initial configuration easier because it allows you to programmatically loop through all of the profiles on your system (using CHGUSRPRF) and add an identity, eliminating the need to do that part of single sign-on configuration by hand.
Additional enhancements include...
- The ability to map many identities to one user without having a source identity for each user
- EIM performance and stability enhancements
- The ability to use a digital certificate as a source for mapping to a user
Managing Passwords Through the iSeries for Integration Server
Local Password Management (LCLPWDMGT) is the other parameter added to CRTUSRPRF and CHGUSRPRF. It allows you to store OS/400 or i5/OS passwords on the integrated Windows server. This allows users to sign on to the integrated Windows server and have that password be used to sign on to OS/400 or i5/OS sessions. One must question whether you really want to store your OS/400 passwords on a Windows operating system, but the option is there if you want to use it.
User-Related Enhancements
If you have ever used PDM or set the experience level for working with message queues, you have used function that was only available to IBM products...until now. Function is now available for application developers to store "last used" data. In other words, the experience level or the last source file and library accessed or customized user-related data...you name it, it can now be stored. Not only can it be stored, but the advantage of using these system APIs to store this data (vs. the application managing this information itself) means that this data will be saved and restored right along with the user's profile. Check out the Update, Retrieve, and Remove User Application Information APIs documented in the Programming>APIs>APIs by Category>Security section of the V5R3 version of the Info Center.
I have mentioned using Application Administration several times. The problem with App Admin up until now is that to view all users' settings, you had to go through each user's profile using iSeries Navigator. There was no way to see the settings unless you wrote to the APIs (which is what I did in my product, SkyView Risk Assessor for OS/400 and i5/OS.) In V5R3, CL commands allow you to manage and display Application Administration settings so you no longer have to go through iSeries Navigator.
The QSYRUPWD and QSYSUPWD APIs have been enhanced to allow you to retrieve and set the encrypted Netserver password as well as the OS/400 or i5/OS password. (These APIs allow you to retrieve the encrypted user profile on one system and set it on another system. They are typically used to propagate passwords around a network of iSeries systems running OS/400 or i5/OS.)
If you have ever been frustrated by trying to find a particular user or group on the Display Object Authority or Edit Object Authority (DSP/EDTOBJAUT) commands, this enhancement should help: As of V5R3, the entries are alphabetized. Yippee!
File System Exit Points and System Values
The combination of two new system values and new exit points allow vendors to provide real-time virus scanning capabilities. Bytware has had a natively running virus-scanning product for several releases, but until now, they were limited to detecting the virus after it had been written to disk. In V5R3, they are taking advantage of new function to detect the virus before it is written to disk. The system value, QSCANFS works in conjunction with the exit points QIBM_QP0L_SCAN_OPEN (scan on open) and QIBM_QP0L_SCAN_CLOSE (scan on close) to determine what file systems are to be scanned and what program does the scanning. The QSCANFSCTL system value works in conjunction with new parameters on directory and stream file objects to determine which objects are scanned and when objects within a file system are scanned (for example, only scan when an object is modified) as well as the action to take when the scan fails.
Open Database File Exit Program API
A new exit point was added, QIBM_QDB_OPEN (Database File Open), which will allow much more flexibility in controlling access to a database file. This exit point returns to an exit program an indication of how the file is going to be opened, e.g., for read-only, read and insert, delete, etc. While I absolutely never recommend using exit programs as a substitute for object-level security, use of this exit point can add another layer of security to your security scheme. For example, you can determine whether it is a QZDSOINIT job, and if the file is being opened for query, allow the open. However, if the file is opened for update, not allow the transaction.
Auditing Enhancements
In addition to the single sign-on enhancements, this is my favorite enhancement in V5R3. Two of the possible values for the QAUDLVL system value, *SECURITY and *NETCMN, create a wide range of audit entries for their respective categories, many of which you probably don't care about under normal circumstances. These values have been broken down into subcategories. You can specify one or more of the subcategory settings and get just the selected audit entries or specify the original value and get all of the audit entries associated with that category.
These are the subcategories for *NETCMN:
- *NETBAS--Basic network events (SSL connections, APPN "firewall" activities)
- *NETCLU --Cluster resource groups
- *NETFAIL--Security-related network failures, e.g., secure socket port not available
- *NETSCK--Mail filtered, mail rejected, give and take socket descriptors
These are the subcategories for *SECURITY:
- *SECCFG--User profile, system value changes, network attributes, etc.
- *SECDIRSRV--Directory services
- *SECIPC--Interprocess communications
- *SECNAS--Network authentication ticket verification (Kerberos)
- *SECRUN--Runtime changes of object ownership, authorization list, etc
- *SECSCKD--Secure socket descriptors
- *SECVFY--Verification of profile handles and tokens
- *SECVLDL--Usage of validation list entries
I don't normally specify *NETCMN for the QAUDLVL system value, but I do recommend using the *SECURITY setting. However, it does produce more records that I really feel is necessary. So in V5R3, I recommend that you specify *SECRUN and *SECCFG instead of *SECURITY.
If you take the new possible settings along with the existing settings for QAUDLVL you will see that you can specify more values for QAUDLVL than it can contain. Therefore, a new system value, QAUDLVL2, was provided as an "overflow" value. For OS/400 or i5/OS to know it's supposed to examine the QAUDLVL2 system value, you must specify *AUDLVL2 in the QAUDLVL system value. If you don't, any values specified in QAUDLVL2 will be ignored.
Miscellaneous Enhancements
Here are some other enhancements in V5R3:
- The Retrieve Authorized Users to an Object (QSYRTVAU) API now includes pathname support.
- All commands found on the SECTOOLS menu can be run by a user that has only *AUDIT special authority. Prior to V5R3, the user needed at least *ALLOBJ and *SECADM special authorities to run the commands.
- Digital certificate APIs allow digital certificates to be stored in LDAP. In addition, digital certificate management APIs have been added to help manage certificate expiration.
- Numerous internal system integrity enhancements and enhancements to the Check Object Integrity (CHKOBJITG) command allow you to continue to have faith in the internal workings of the operating system and SLIC.
- New crypto APIs support encrypt, decrypt, hashing, RSA key generation, and Diffe-Hellman key exchange. Also, a FIPS-compliant JCE provider that will be available for both V5R2 and V5R3 is currently undergoing certification testing.
- Undergoing the Common Criteria certification process: The Common Criteria is a replacement for the C2 certification of years past.
I hope you've enjoyed your "tour" of the V5R3 security enhancements and can take advantage of these enhancements--many of which will make your life much easier--very soon.
Carol Woodbury is co-founder of SkyView Partners, a firm specializing in security consulting, remediation services and security assessments, including the risk assessment product, SkyView Risk Assessor for OS/400 and i5/OS. Carol has over 13 years in the security industry, 10 of those working for IBM's Enterprise Server Group as the AS/400 Security Architect and Chief Engineering Manager of Security Technology. Look for Carol's second book, Experts' Guide to OS/400 and i5/OS Security.
Carol can be reached at
Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.
Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.
MC Press books written by Carol Woodbury available now on the MC Press Bookstore.
 |
||
 |
|
IBM i Security Administration and Compliance: Third Edition Don't miss the newest edition by the industry’s #1 IBM i security expert. List Price $71.95 Now On Sale
|
 |
|
Mastering IBM i Security Get the must-have guide by the industry’s #1 security authority. List Price $49.95 Now On Sale
|
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online