RE: Penetration testing IBMi 7.3?

Laurence,

I would start by testing the areas that do break on OS and/or PTF applies.
We've had issues with all of the below.

FTP
SFTP
SSH
SSL (ciphers, certs, etc)
All/any email sent from IBMi LPAR
Compiles to previous release
Run IBM pre-upgrade verification tool - run_pruv.bat
Any OS upgrade V6R1, V7R1, V7R3 changed public authority from *USE to *EXCLUDE for system object QPMLPMGT. This object is used to confirm license product information.

Paul



-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Laurence Chiu
Sent: Tuesday, July 21, 2020 1:01 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Penetration testing IBMi 7.3?

We arevmoving a production system from one data centre to another. There will be prod in one, DR in the second. The application is pure RPG on IBMi with green screen access., There is no web application. The Power servers are behind application firewalls and the only external access to the servers is via the corporate VPN.

There is discussion that we need to perform penetration testing but I cannot work out what that scope might be. We do have web based applications but they don't talk to IBMi at all. The closest we have are some web based applications that grab balances from a mainframe application using MQ messaging and then the CICS transaction might send a message to the IBMi application over MQ to get a balance from another system.

I guess we could ask our pen testing organisation to start with the IP address of the application web server and then see if they can somehow get to the IBMi server console but that seems very tricky since the IBMi box isn't advertising any services and supports only 5250 access, MQ and Correct:Direct.

Anybody in a similar position can provide some insight? Thanks
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2flists.midrange.com%2fmailman%2flistinfo%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-ed24f2b9db01e7fd1593f4c98541b9b61bac0e00
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2farchive.midrange.com%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-d8969299e7b0ec928220a8e421d8ba31ed903aa8.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2famazon.midrange.com&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-7bdbc8b1333de5b4f397fba47414609fc62fe2d1