Scott covers it quite well :).
I'll add my $.02 since I just did this on a v6r1 box. I found testing
worked best while allowing both secure and insecure. You do have to restart
telnet services with any of the changes. Also you have to apply the server
cert to all the server services. I know this sounds odd and it doesn't make
much sense but mine wasn't working until I did so. I found that requirement
as a foot note in some IBM docs I ran across. I would try it without doing
so first because I really find it odd but if you can't connect securely
after all is said abd done apply the cert to all services.
-jason
Sent from my mobile
-----Original message-----
From: Scott Klement <midrange-l@xxxxxxxxxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Sent: Fri, Mar 16, 2012 22:36:45 GMT+00:00
Subject: Re: Client authentication
hi James,
In the HTTP *ADMIN instance, go to the "Digital Certificate Manager" (If
you're on 6.1 or higher, you'll need to click "IBM i Management /
Internet Configurations" to get to the DCM.)
Click "Select a Certificate Store", and then choose the *SYSTEM store.
You'll need to know the password for the *SYSTEM certificate store that
was assigned when it was created.
On the left navigation bar, again, click "Update application
definition", then "Server", then "IBM i TCP/IP Telnet Server". On the
following screen, make sure you have "Define the CA trust list" and
"Client authentication required" checked. Click "Apply"
On the left navigation bar on the screen, choose "manage applications",
then "define CA trust list", then "Server", then "IBM i TCP/IP Telnet
Server"
The next screen provides a list of all the SSL/TLS certificate
authorites installed on your system. If you only want to trust
certificates that you created, choose "LOCAL_CERTIFICATE_AUTHORITY" and
uncheck all the others. Click "OK" to activate.
You might also want to block non-SSL connections. To do that:
CHGTELNA ALWSSL(*ONLY)
I'm not certain whether you need to restart the telnet server for all
these changes to take effect? But, I assume so, so you'll want to do
(make sure you're not using a telnet connection to do this!)
ENDTCPSVR *TELNET
WRKACTJOB SBS(QSYSWRK)
Wait for the telnet server to end. To do that, look for any jobs whose
name starts with QTVxxxx these are telnet server jobs. hit F5 to
refresh until all of them are ended.
STRTCPSVR *TELNET
Now, the Telnet server should only accept connections from certificates
that were assigned by the LOCAL_CERTIFICATE_AUTHORITY CA certificate.
(You'll probably want to test this to verify that it all worked.)
Have fun.
On 3/16/2012 4:11 PM, James Rich wrote:
I'm fairly certain this is possible, but my reading so far hasn't turned
up an answer.
I want to permit uses to connect to our system using iSeries Access but
only if that user has a certificate that we have previously issued. We
want to issue certificates to users and only accept connections from
clients that have one of those certificates. Can this be done? If so,
how?
midrange.com
