Re: Weak LAN Manager hashing permitted

If the whole point of upping QPWDLVL from 0 is to
A - Allow more characters and in starting positions also
B - Stop issues with NetServer hurling because of case issues on passwords
C - To get past the "Weak LAN Manager hashing permitted" issue
then is there any reason NOT to go to level 3 instead of 2?
Any reason not to go to Level 3 besides:
"i5/OS NetServer passwords for Windows 95/98/ME clients will be removed
from the system."


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Rob Berendt <rob@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 05/04/2016 07:10 AM
Subject: Re: Weak LAN Manager hashing permitted
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



<snip>
What's your QPWDLVL set too?

LM passwords are not allowed at level 1 or level 3.
</snip>


<snip>
If IBM i bind non specific issue I suspect the resolution will be to
upgrade our QPWDLVL from 0. We're planning on going to 2 shortly anyway.
Already increased it to 2 on one sandbox lpar.
</snip>

Is level 2 no good in resolving this then?

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Charles Wilt <charles.wilt@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 05/03/2016 04:38 PM
Subject: Re: Weak LAN Manager hashing permitted
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

What's your QPWDLVL set too?

LM passwords are not allowed at level 1 or level 3.

Charles

On Tue, May 3, 2016 at 3:02 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

I am getting this other ding on my security report.
I am not sure if it is a domino issue or if it is because of something
that is not 'bind specific' to a particular IP address but is creeping
over to include the IP address of my Domino servers on this lpar of IBM

i.

Details. This lpar of IBM i has multiple IP addresses assigned to it.

One

generally reserved for "IBM i" stuff and a few others for various Domino
servers on this lpar. So far we have only told the security scan a few
initial IP addresses to check internal to our corporation. One of them
being one of the Domino servers on this lpar. My first step is to
determine if this is a Domino issue or is it just picking on the Domino

IP

address when it's really a IBM i issue that didn't bind to any

particular

IP address.

Here is the ding:
3.2. Severe Vulnerabilities
3.2.2. Weak LAN Manager hashing permitted (cifs-generic-0005)
Description:
This system allows remote users to authenticate using the LAN Manager

(LM)

password hashing mechanism. The LM hash can easily be cracked by a user
eaves-dropping on the network. Microsoft provides a more secure
authentication method called NTLMv2 that should always be used instead

of

LM. NTLMv2 is available in Windows NT 4.0 SP4 and later (including

Windows

2000, Windows XP, and Windows 2003). For more information, see MSKB
article Q147706.

Affected Nodes: Additional Information:
xx.xx.xx.xx Server did not return extended security data.
where xx.xx.xx.xx is the IP address of the Domino server on this lpar of
IBM i.

Domino or IBM i bind non specific issue?

If IBM i bind non specific issue I suspect the resolution will be to
upgrade our QPWDLVL from 0. We're planning on going to 2 shortly

anyway.

Already increased it to 2 on one sandbox lpar.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.