Re: HTTPAPI and Ciphers on 7.1

As usual, Steve speaks truth.

I have a large inventory of old POWER5, 6, and 7 parts as I recycle many computers from customers. I sell parts nearly every week and absolutely every month to bail out people who have these ancient machines, no maintenance coverage, and no real plan.

IMPORTANTLY Parts I recycled years ago because 'everyone has a crapload of these things' now are scarce and I wish I hadn't recycled them. They are worth good coin today. POWER5 planar boards is one example. Call around those used vendors you know and ask them if they have these things sitting. They don't. Recently my guy had to reach to Europe to find a POWER6 machine but luckily the customer ended up not needing it!

I am in fact this morning wrapping up a recovery for a customer on POWER6 who blew it up by literally ignoring it to death. They lost 'one too many drives' a week ago last Friday. That day they found out they no longer had maintenance on the machine. Hardware problem discovery, parts acquisition and repair completed over that weekend into Monday. Recovery began in earnest from BRMS Backup media one week ago today. This is only a 3TB system but on old LTO4 tapes with a large number of IFS objects and an incredible number of private authorities.

Side note: If you have never tested your recovery procedure you cannot know if it will work, but importantly you won't know if, like these guys, even if the server is repaired in 20 minutes you'll be down for a week just watching tapes spin!!

Move to the cloud... Moooooove to the Cloud!!

<vendor response>

I know a great cloud for this. :-)
Call me 616.260.4746 or email lbolhuis@xxxxxxxxxxxxxxx

</vendor response>

- Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 5/3/2020 2:41 PM, Steve Pitcher wrote:

The POWER5...that's the biggest issue as far as I'm concerned. If it's even on extended maintenance, it's still assuming IBM has parts for it available and nearby. I remember even 3-4 years ago IBM reaching out for old POWER5 parts from customers because its inventories were low. I also remember having to get a POWER7 card shipped from Mechanicsburg to Toronto to Halifax and had my backup system down for 48 hours because a particular part wasn't even available in Canada, let alone the town the system was located.

Steve Pitcher

iTech Solutions Group, LLC

p: (203) 744-7854 Ext. 176 | m: (902) 301-0810

www.itechsol.com | www.iInTheCloud.com



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx] On Behalf Of Jon Paris
Sent: Friday, May 1, 2020 6:19 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: HTTPAPI and Ciphers on 7.1

I guess another option would be to switch to using node/php/python for the data exchange. If I recall correctly they can be configured to use any encryption method and do not have to rely on the system supported ciphers.

But Steve's solution is the best - get the heck off that old release!

On May 1, 2020, at 4:00 PM, Steve Pitcher <SPitcher@xxxxxxxxxxxx> wrote:

You gotta get off that POWER5 Spencer. New machine or go to the cloud.

Or stick some sort of proxy server in front of it.

Steve Pitcher

iTech Solutions Group, LLC

p: (203) 744-7854 Ext. 176 | m: (902) 301-0810

www.itechsol.com | www.iInTheCloud.com



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx] On
Behalf Of Carter.Spencer
Sent: Friday, May 1, 2020 2:44 PM
To: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
Subject: HTTPAPI and Ciphers on 7.1

We have an existing relationship with a vendor where we exchange info with using HTTPAPI (ver 1.4). They are updating their security to use TLS 1.2 and 256 encryption.
Our Power5 is stuck at OS 7.1 with no virtually no chance to be upgraded.
I inherited this process so I don't fully understand it so I wanted to run it by you experts to verify we may need to find another system to communicate with them.

Our QSSLPCL is:
*TLSV1.2
*TLSV1.1

Our QSSLCSL is:
*RSA_AES_256_CBC_SHA256
*RSA_AES_128_CBC_SHA256
*RSA_AES_128_CBC_SHA
*RSA_AES_256_CBC_SHA

The error I get when trying to communicate with them is:
(GSKit) Peer not recognized or badly formatted message received.
ssl_error(415): (GSKit) Peer not recognized or badly formatted message received.

They say they are using openssl's 1.1.0 definition of ciphers matching HIGH.
They did give me a file of their ciphers and there wasn't an exact match but these were the closest:
SRP-RSA-AES-256-CBC-SHA
SRP-RSA-AES-128-CBC-SHA

I was expecting a different error message if it was just our ciphers not matching. Regardless, is there no hope to get this working?

Spencer Carter
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com