RE: iSeries FTP security -- MIDRANGE-L

On Mon, 16 May 2005, Ingvaldson, Scott wrote:

I'll certainly agree that many, if not most, shops do not pay enough
attention to security.  What I disagree with is that this particular
"exploit" is as serious as is implied, based on the requirement of a
valid, authenticated user to perform it.  That's like saying that
leaving your QSECOFR password set to default and having a direct
internet connection is a "serious vulnerability."


Doing so *does* constitute a serious vulnerability.

Certainly, Rob, a sufficiently knowledgeable and talented user could use
FTP to go after
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr/../../payroll.file/payroll.mbr
and download the payroll file, but should this user have FTP access to
this system at all?  Is this really an "exploit" or, to coin a phrase
"Working As Designed?"  How difficult is it to write an Exit Point
Program to restrict all FTP access to authorized FTP users only?


So to adequately secure an iSeries I have to write a program?

Exploits can take advantage of coding flaws, configuration flaws, and design flaws. That something is working as designed does not in and of itself mean that it not an exploit. Look no further than ActiveX for proof of that.


Regards,

Scott Ingvaldson
iSeries System Administrator
GuideOne Insurance Group

-----Original Message-----
date: Mon, 16 May 2005 14:28:04 -0500
from: rob@xxxxxxxxx
subject: RE: iSeries FTP security

Scott,

I respectfully disagree.

A bulk of 400 shops do not granualize their security enough.  For
example,
they use some sort of group profile to allow users to get into the
'accounting' data library.  Once in there they hope that 5250 menu
security works.  Now comes along a ftp project request.

One alternative might have been to change all their 5250 programs to
USEADPAUT(*YES) and have some early program owned in the call stack to
be
owned appropriately and then also allow read access to individual users
of
the one file to download.

Another alternative is to leave the bulk of the security model the same,

but use an ftp exit point program to only allow from one member in one
file:
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr

But by canonization you could do
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr/../../payroll.file/payroll.mbr
and get to what you need.  Because, if the exit point followed my poor
technique of just checking the left to match with what they are
authorized
to - they're toast.

Rob Berendt
--
Group Dekko Services, LLC

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


James Rich

It's not the software that's free; it's you.
        - billyskank on Groklaw