Re: Security and iSeries Navigator Management Central

Hey what can I say, I'm not the admin here....just a lowly
developer...so of course I can't know anything about admin or
security. :/

IIRC, it was decided that it'd take too much CPU resources to run all
5250 traffic through SSL.


I've downloaded the root CA cert, and loaded it using various methods,
but I can't get it to work. See:
http://archive.midrange.com/midrange-l/201007/msg00191.html

If you got any thoughts as to what's wrong, I'd love to hear them.

Charles

On Fri, Jul 23, 2010 at 1:08 PM, Lukas Beeler
<lukas.beeler@xxxxxxxxxxxxxxxx> wrote:

On Fri, Jul 23, 2010 at 18:38, Charles Wilt <charles.wilt@xxxxxxxxx> wrote:

You are correct, and no we don't use SSL for non-Admin 5250 sessions here.

That's very bad. Any connections to your IBM i should be encrypted.
Using unencrypted Telnet, FTP or other protocols which are used to
exchange either authentication data or sensitive data makes your
system less secure than an unpatched NT4 server (which, at least
always used NTLMv1). Unfortunately, IBM still ships their systems with
an insecure default configuration. I've submitted a DCR on this a few
years ago, but have never gotten any reply from them.

Getting SSL connectivity should be easy. All you need is the Root CA
cert (probably an internal one). Find out which it is, then add that
to your IBM i access configuration, and you should be access whatever
your user can access - even Management Central, if you haven't gotten
locked out there.

--
Read my blog at http://projectdream.org
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.