RE: Remote Access (Again)

[Justin Haase <JHaase@xxxxxxxxxxxxx>]

> last time I discussed with security people,
> a sniffer just hanging on the internet can only
> sniff traffic there

So if your iSeries is on the internet (port 23 or any port for that matter)
then the sniffer could sniff it.  Internal network with no direct internet
access, no.  Access to internet, fair game.

Turning ICMP off is the first step in effective security (no ping
responses).

Long and the short of it is that any open port from any type of system open
to the internet is a vulnerability and needs to be weighed against risk and
potential damage.  A firewall is a good step.  An intermediary server is
even better - running some sort of terminal emulator which is web/java
based.

**Good Solution**
<Internet> ---> (443)Firewall(443) ---> (443)Intermediary(23) --->
(23)iSeries

**BAD Solution**
<Internet> ---> (23)iSeries

jch