Well, there is a web presence if you keep the *ADMIN server running (highly
recommended since it's where many of the best management tools are).
I'd just make sure all telnet is on the SSL port and not clear (port 23) and
shut down the TCP servers you know you are not using. For instance, if you
know you don't allow SSH, shut down the *SSHD daemon. Check to be sure you
don't have open shares with Net Server or my favorite failure, guest
access....
Once you've done your due diligence, let them have at, no restrictions. I'm
not sure that restricting a penetration test to certain parameters is worth
even doing. The whole point is to find things you don't know about.......
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Laurence Chiu
Sent: Tuesday, July 21, 2020 12:01 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Penetration testing IBMi 7.3?
We arevmoving a production system from one data centre to another. There
will be prod in one, DR in the second. The application is pure RPG on IBMi
with green screen access., There is no web application. The Power servers
are behind application firewalls and the only external access to the servers
is via the corporate VPN.
There is discussion that we need to perform penetration testing but I cannot
work out what that scope might be. We do have web based applications but
they don't talk to IBMi at all. The closest we have are some web based
applications that grab balances from a mainframe application using MQ
messaging and then the CICS transaction might send a message to the IBMi
application over MQ to get a balance from another system.
I guess we could ask our pen testing organisation to start with the IP
address of the application web server and then see if they can somehow get
to the IBMi server console but that seems very tricky since the IBMi box
isn't advertising any services and supports only 5250 access, MQ and
Correct:Direct.
Anybody in a similar position can provide some insight? Thanks
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
