Re: Fix Security (was: Paging file)

["Ed Fishel" <edfishel@xxxxxxxxxx>]

From: Steve Landess <steve_landess@hotmail.com>

> SO, what is the solution to the problem, Leif?
>
> What can IBM do to fix it?  Create a new level of system security?

Steve,

The programs that Leif writes about that can manufacturer pointers or
change themselves to system state are all patched programs. You can improve
the security of your system by preventing patch programs from being
restored onto it. One of the first steps to good security on iSeries is to
only use programs that are created with the trusted translator.

Some of my recommendations for best security are:

1. Move to the latest release of OS/400. With each new release IBM
continues to improve the security and integrity of the system. Once on the
latest release be sure to install PTFs for security and integrity fixes.

2. Set the QSECURITY (security level) system value to 40 or 50.

3. Set the QVFYOBJRST (verify object on restore) system value to 3 or
higher to verify the signatures of programs (in V5R1) and commands (in
V5R2) restored onto the system.

4. On V5R2, set the QFRCCVNRST (force conversion on restore) system value
to 6 or 7 to force the retranslation of all restored programs. If the
program was patched this will remove the patches. If the program does not
have observability it will not be restored to the system.

5. On V5R2, use the STRSST option to lock down the security relevant system
values. This will prevent installed user state programs from changing these
system values.

6. Let only trusted people use DST/SST.

Ed Fishel,
edfishel@us.ibm.com