|
John,Although ftp exit programs are relatively easy to write, a whole bunch of them was found to be flawed a couple of years ago. OBDC exit frograms are an order of magnitude more difficult to write than ftp exit programs. It's not because of the APIs involved - API programming is more or less the same for all exit points. It is because the complexity of extracting the variables needed to make a decision is very high. I did some research on ways to bypass odbc exit program security for my book, and there some probable security holes that take acute security consciousness to deal with.
Remember that ODBC exit points can examine only ODBC traffic. They do not examine DRDA, and are oblivious to internal sql statements. SQL commands issued by interactive STRSQL are not examined. SQL commands incoming from another database via DRDA thru commercial gateways or from a simple AS400 "CONNECT TO" are not examined.
I suggest that you get a commercial product to address your problem. The security vendors are much more likely to deal better than you with the security and complexity issues.
Some products are native to the iSeries and provide host-based protection, but there are other solutions to your problem, external to the iSeries. The advantage of external solutions is that they have the ability to protect against all types of database access, even DRDA.
For example, Imperva sells an appliance that works like a switch and analyzes database traffic passing thru it. If you have additional databases to protect besides your iSeries and TCO is shared, then it even makes business sense to use it.
http://www.imperva.com/products/securesphere/database_security_gateway.html Shalom Carmel ---------------- www.hackingiseries.com----- Original Message ----- From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of John_Bresina@xxxxxxxxxxxxxxx Sent: Friday, September 15, 2006 2:37 PM To: Midrange Systems Technical Discussion Subject: Re: ODBC Security
Does anyone have an example of an exit program for ODBC. I am not a programmer so I wouldn't want to try to write one. We have an audit requirement to secure ODBC by the end of October on our production partitions. John Bresina Jr Sr Server Engineer - Midrange Team Allianz Life of North America 5701 Golden Hills Drive Minneapolis, Mn 55416 763 582 6761
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
