RE: iSeries FTP security -- MIDRANGE-L

Hi Joe

thanks for replying again. I considered a couple of possible responses and discarded all of them.

Best to let your response speak for itself.

Thanks again for your thoughts

All the best
Evan Harris

At 11:55 a.m. 19/05/2005, you wrote:

> From: Evan Harris
>
> These statements - and the others like these that you include in this
> email
> and elsewhere - are disappointing as they are of course intended to
> establish what (in your opinion) I know or don't know rather than
address
> what I actually said and also to disparage my skills while
establishing
> you
> as an expert (which you don't really need to do - your technical
skills
> and
> knowledge are more than enough to do this)

Dude, chill out.  Before you go assigning intent, I suggest you take a
good stiff drink and relax.  I'm not disparaging anything, except
perhaps the practice of using tools with which you are not completely
familiar.


> No, this was part of one of my points about why it is required and why
it
> was foolhardy to simply respond with an "I don't know how to do that"
> instead of implementing FTP or ODBC in response to an end user or
> management request. It was also responding to your blanket assertion
that
> we shouldn't implement utilities we know nothing about.

An assertion I stand by.  Implementing utilities you know nothing about
is lunacy.


> You simply chose to ignore the other points and the context and jumped
> onto (one of) your favourite hobby horses.

I actually did quite a good job of addressing your statements.  YOU'RE
the one who implied that not supplying FTP access leads to the demise of
the iSeries, a point I disagree with, for exactly the reasons I stated.


> I never said we did. I merely stated that this is one of the reasons
we
> supply FTP and ODBC to people on request. It's real world enough that
I
> think you would find most people would understand where I am coming
from
> even if they didn't entirely like the way it ends up getting
implemented.
> While most of us might share your ivory tower mind-set regarding the
right
> way to set up security you would find that out there in the day-to-day
> trenches these are utilities the end users think THEY understand and
> demand.

Security is not ivory tower.  It's the foundation of your IT system.


> >Really, I'm interested to know what purpose is served by FTP that
can't
> >be handled with 15 minutes of programming, or how big a file it is
that
> >copying it to a holding area actually takes too long for the end
user.
>
> *sigh* The transfer of data to suppliers that want access to a subset
of
> product code matching data to validate their product code and their
other
> product data.

Subset means a copy.  Not FTP'ing the whole file.  Thus, as I clearly
stated, you simply copy the subset to a sandbox and away you go.  Ta da!
We're all happy!

I get the idea that you'd rather do anything than agree with me, Evan.


> Yes, this file would be in a separate area and yes each of the
suppliers
> has a separate low level sign-on, but does this mean I should not
think
> about an exit point for additional security to restrict what they can
do
> via FTP ? And if I code my own exit point, shouldn't I understand the
> nuances of how the path is returned ? And further, if I discover
something
> I've overlooked, shouldn't I be glad to learn that and take it into
> account to see whether it affects me ?

Dude, I never said a word about exit points.


> Joe this is all irrelevent to my original comment that I was happy to
> learn of a method of circumventing the FTP exit points depending on
> how they were coded.

My entire response was based on your implication that not keeping up
with the NT guys meant the demise of the iSeries.  To my mind, this is
irresponsible claptrap, and I made it clear why I think so.


> Disregarding your red-rag response to my SQL Server and NT guy
comments
> which you have exaggerated and distorted, the points I made were:

Let's try this one more time: I was responding only to the implication
that not providing FTP access to production data somehow meant the
demise of the iSeries.


> Your actually haven't addressed these and this discussion is pointless
> unless you do. I suspect it will be pointless anyway, but there you
go.

One last time: I was responding only to the implication that not
providing FTP access to production data somehow meant the demise of the
iSeries.  Is that clear?


> Your last point is simply not worthy of this forum or you Joe. I don't
> know how you managed to get from my comment that I was happy to learn
> of a trick to circumvent exit point coding to implying that I had
> somehow sacrificed security to make my job easier.

If you provide FTP access to production data, I believe you're doing a
rotten job of security.  Have I finally made my point?  The rest of your
discussion is just ducky, as long as you leave the "keeping up with the
SQL guy" stuff out of it.

Joe