Re: Security - Scripting Passwords

[rob@xxxxxxxxx]

Several problems
1)  password expiration policy
2)  passing of the password in the clear across the wire
3)  storing the password in a file or data area

Do not store passwords with the scripts.  If writing a sockets based 
application shudders you, then append the user id and password with the 
rest of the script into QTEMP.

1)  Does that password policy only apply to 'real' iSeries users?  If so 
then a good ftp exit point program could use a file of users, or a ldap 
entry, to convert the 'dummy' user to a real iSeries user.  We do this 
with our custom exit point.  Although we are looking at using ldap.  Hmm, 
I wonder if any of the exit point vendors support ldap yet?
2)  Can this be worked around using SSL or some such animal?
3)  Storing the password in a file or data area.  You could store it 
encrypted in one of these animals.  Then any program that reads it would 
have to decrypt it.  I've written some crude encryption routines that I 
use when sending passwords across the wire for password propagation 
(QPWDVLDPGM).

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Steve Martinson" <SMartinson@xxxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
01/21/2004 02:21 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
<midrange-l@xxxxxxxxxxxx>
cc

Fax to

Subject
Security - Scripting Passwords






We have a discussion going here about the benefits and pitfalls of
having remote scripted processes utilize OS/400 profiles and, thus,
their scripted passwords in order to connect and execute.  We run into
issues contrary to our password expiration policy, the passing of the
password in the clear across the wire, not to mention the fact that the
password exists in the clear in a file or data area.

I am seeking any and all suggestions / opinions on the best way around
using scripted sign on credentials. 

Best regards,

Steven W. Martinson, CISSP, CISM
Manager of OutLink Security
Jack Henry & Associates, Inc.
7800 Willowchase Blvd.
Houston, TX.  77070
     voice                               281.517.8000
     external fax                281.517.8157
     internal ext                471800

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.