× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Well, there is a web presence if you keep the *ADMIN server running (highly
recommended since it's where many of the best management tools are).

I'd just make sure all telnet is on the SSL port and not clear (port 23) and
shut down the TCP servers you know you are not using. For instance, if you
know you don't allow SSH, shut down the *SSHD daemon. Check to be sure you
don't have open shares with Net Server or my favorite failure, guest
access....

Once you've done your due diligence, let them have at, no restrictions. I'm
not sure that restricting a penetration test to certain parameters is worth
even doing. The whole point is to find things you don't know about.......

--
Jim Oberholtzer
Agile Technology Architects

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Laurence Chiu
Sent: Tuesday, July 21, 2020 12:01 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Penetration testing IBMi 7.3?

We arevmoving a production system from one data centre to another. There
will be prod in one, DR in the second. The application is pure RPG on IBMi
with green screen access., There is no web application. The Power servers
are behind application firewalls and the only external access to the servers
is via the corporate VPN.

There is discussion that we need to perform penetration testing but I cannot
work out what that scope might be. We do have web based applications but
they don't talk to IBMi at all. The closest we have are some web based
applications that grab balances from a mainframe application using MQ
messaging and then the CICS transaction might send a message to the IBMi
application over MQ to get a balance from another system.

I guess we could ask our pen testing organisation to start with the IP
address of the application web server and then see if they can somehow get
to the IBMi server console but that seems very tricky since the IBMi box
isn't advertising any services and supports only 5250 access, MQ and
Correct:Direct.

Anybody in a similar position can provide some insight? Thanks
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.