LPAR ID? ---> OS/400 security issues

["Milt Habeck" <mhabeck@xxxxxxxxxx>]

Dear David,

If you can't tell what LPAR you're on, that's a generously sized
IT security vulnerability.

IBM has published what they call the LPAR API Toolkit which
includes commands to display the same information currently available 
in the DST/SST tool. However, it's only available from v5r1 forward.
The LPAR API Toolkit includes the WRKLPARSTS (Work with
LPAR Status) and RTVLPARSTS commands, which IBM intends to be
used within CL programs used to control LPAR resource apportionment.

We discovered this while developing our OS/400 Database Integrity
software called 'Stitch-in-Time.'  The product required compatibility 
back to v3r7 so we couldn't use the API Toolkit. Instead, we had to use 
the Materialize procedure to get the information we needed.

Stitch-in-Time observes, analyzes, and reports details about data
changes in critical databases without any changes to programs or files. 
So, if a user still manages to make a change in the wrong LPAR, at least 
the security officer can quickly get to the root of the accident and fix it 
with confidence. 

More information about Stitch-in-Time OS/400 Database Integrity 
software is available here:
http://www.unbeatenpathintl.com/award/source/1.html. 

Warm regards,

Milt Habeck
Unbeaten Path International
North America: (888) 874-8008
International: (262) 681-3151
European contact: (44) 1-737-824248
mhabeck@xxxxxxxxxx
www.unpath.com





++++++   +++++++   +++++++   +++++++   +++++++   +++++++
From: David Gibbs
To: midrange-l@xxxxxxxxxxxx
Sent: Tuesday, September 07, 2004 10:52 AM
Subject: Re: LPAR ID?

System name can be changed by the user. I need something that is canonical.

david


++++++   +++++++   +++++++   +++++++   +++++++   +++++++
From: David Gibbs [mailto:david@xxxxxxxxxxxx]
Sent: Tuesday, September 07, 2004 10:05
To: midrange-l@xxxxxxxxxxxx
Subject: LPAR ID?

This has been asked before ... but I thought I'd see if anyone has
figured out a way for a user to determine which LPAR they are using
without having to call an API?

Thanks!

david