Re: Continuing :2001 problems

I agree with Roberto. You need to upgrade your ciphers on IBM i. I'm
going through this now. Domino first.

There is a workaround in browsers. There's is an option on many of them
to turn on and allow crappy ciphers. Many of them plan on removing that
option.

Read the following:
http://www-01.ibm.com/support/docview.wss?uid=nas8N1019971
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020876
http://www-01.ibm.com/support/docview.wss?uid=nas8N1020681

Pay close attention to this on the right:
Modified date:
YYYY-MM-DD

Staying current with ciphers is important. Failure to do so may:
- Have you fail security audits.
- Have a browser update no longer connect to your system (ya think?)
- Expose your data.

Do NOT just put on a cume and think all is well!!!
Security patches come out much more frequently.
New Hiper and security groups for 7.1 came out just this week.

http://www-912.ibm.com/s_dir/sline003.NSF/GroupPTFs?OpenView&Start=1&Count=30&Expand=2#2
- Cumulative package C5317710 began shipping worldwide: 19 Nov 2015.

http://www-912.ibm.com/s_dir/sline003.nsf/2d3aff1c6b4d6ce086256453000d971e/c69211d3133949f886257c1c00513742?OpenDocument

IBM does a great job of monitoring CVE's and getting out new PTF's.

Many of the cipher PTF's go into 5733SC1, which is:
IBM Portable Utilities for i, and,
OpenSSH, OpenSSL, zlib


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Roberto José Etcheverry Romero <yggdrasil.raiker@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 04/07/2016 09:35 PM
Subject: Re: Continuing :2001 problems
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



I'll bet you have to read the archives searching for ssl, disabling old
ciphers, disabling ssl v2 and v3, etc. Your webserver is not using a
secure
encryption protocol and you have to disable the unsafe ones manually
(otherwise you risk breaking applications). You will have to research
everything that runs on those machines to be certain that no program is
using the unsafe ciphers.

Best Regards,

Roberto

On Thu, Apr 7, 2016 at 8:19 PM, Jack Tucky <jacktucky@xxxxxxxxx> wrote:

Sorry we are at 7.1, just loaded and applied SF99710

On Thu, Apr 7, 2016 at 7:18 PM, Jack Tucky <jacktucky@xxxxxxxxx> wrote:

I have 3 systems now that I can't get to :2001 to look at

certificates,

etc.

I've posted before and never been able to connect one any system.

I start by opening chrome or IE and go to http://192.168.2.60:2001

The browsers URL gets changed to
https://192.168.2.60:2005/ibm/console/index.do, and then I get a

message

from chrome:

This site can’t provide a secure connection

*192.168.2.60* uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
chrome or IE basically give the same message. I just applied SF99710

to

this server and IPL'd. I have groups ready to load. This can't be a

PTF

problem. Please help

Jack

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.