Re: Setting up FTP to AS/400 for the first time

[booth@xxxxxxxxxxxx]

Rent space on a machine on the web and store your file(s) there. The only 
traffic on your site then will be from your own machine.
_______________________
Booth Martin
Booth@MartinVT.com
http://www.MartinVT.com
_______________________




jcrowley@ifasys.com
Sent by: owner-midrange-l@midrange.com
09/29/2000 11:53 AM
Please respond to MIDRANGE-L

 
        To:     MIDRANGE-L@midrange.com
        cc: 
        Subject:        Setting up FTP to AS/400 for the first time



I work for a smallish software company. We are currently using four comm 
lines
for client support and to send software updates via SNADS. The competition 
for
these four lines is getting hot, so we're looking at alternatives before 
going
out and setting up more lines.

We believe we can provide our software updates via FTP, but we don't want 
to
implement anything until we're fairly sure our security mechanism will 
work. Can
someone tell me where the holes are in our scheme?

I have set up an FTP user profile that has no special authority, no 
password, an
initial program of *SIGNOFF, and a library list that contains only one 
library.
The only objects that definitely will be placed in this library are save 
files
intended to be available to our clients. (The save files contain program 
and/or
file updates or additions. They would never contain a complete program or 
file
library. They would also never contain any implementation procedures or
documentation.)

I have created an FTP logon exit program and a file that contains a very 
small
list of valid user profiles for FTP. The exit program compares the 
incoming
profile with the list in the file and either accepts or rejects the logon. 
If
the logon is accepted, the user profile is changed to the single FTP user
profile described above.

I have a second exit program that looks at incoming FTP requests. All 
requests
are rejected except for the ability to establish a connection, list the 
current
library and get a file from that library. We will log all FTP requests 
from
within these exit programs, but I'm still working on that piece.

We do not have all libraries on our system designated as public *EXCLUDE, 
and I
know that it's recommended. To date, we have secured our system from the 
outside
by using our firewall to pretty much shut down anything incoming and 
keeping
some servers (like FTP) turned off. We know that improving our security 
for an
internet world is in our immediate future, but we would like to plan it
thoroughly to minimize work disruption. Will the plan being considered for 
FTP
be fairly secure if we haven't taken this step yet?

What other things should we look at to close any holes into our system 
that
might occur with this setup? More importantly, are there any security 
risks for
our clients in this? I can't see that there is any risk for them, but 
perhaps
I'm missing something major.
Thanks for your help!

Janet Elam Crowley
Systems Analyst
IFA Systems






+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to 
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: 
david@midrange.com
+---




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---