Re: Penetration testing IBMi 7.3?

[Laurence Chiu <lchiu7@xxxxxxxxx>]

Thanks for the advice.

The box in question just had a brand new IBM i-7.3 installation performed
and all the latest PTF s applied. This was done by IBM.

The rest of the work to bring the system back to production status is to
load back all the backups taken from a IBM i7.1 installation which are only
the application libraries and data.

I would imagine now the system is in a fairly safe state but I could
certainly ask the vendor to look at the recommendations you make below.

On Wed, Jul 22, 2020, 9:04 AM Steinmetz, Paul via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

> Laurence,
>
> I would start by testing the areas that do break on OS and/or PTF applies.
> We've had issues with all of the below.
>
> FTP
> SFTP
> SSH
> SSL (ciphers, certs, etc)
> All/any email sent from IBMi LPAR
> Compiles to previous release
> Run IBM pre-upgrade verification tool - run_pruv.bat
> Any OS upgrade V6R1, V7R1, V7R3 changed public authority from *USE to
> *EXCLUDE for system object QPMLPMGT. This object is used to confirm license
> product information.
>
> Paul
>
>
>
> -----Original Message-----
> From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
> Laurence Chiu
> Sent: Tuesday, July 21, 2020 1:01 AM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
> Subject: Penetration testing IBMi 7.3?
>
> We arevmoving a production system from one data centre to another. There
> will be prod in one, DR in the second. The application is pure RPG on IBMi
> with green screen access., There is no web application. The Power servers
> are behind application firewalls and the only external access to the
> servers is via the corporate VPN.
>
> There is discussion that we need to perform penetration testing but I
> cannot work out what that scope might be. We do have web based applications
> but they don't talk to IBMi at all. The closest we have are some web based
> applications that grab balances from a mainframe application using MQ
> messaging and then the CICS transaction might send a message to the IBMi
> application over MQ to get a balance from another system.
>
> I guess we could ask our pen testing organisation to start with the IP
> address of the application web server and then see if they can somehow get
> to the IBMi server console but that seems very tricky since the IBMi box
> isn't advertising any services and supports only 5250 access, MQ and
> Correct:Direct.
>
> Anybody in a similar position can provide some insight?  Thanks
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
> unsubscribe, or change list options,
> visit:
> https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2flists.midrange.com%2fmailman%2flistinfo%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-ed24f2b9db01e7fd1593f4c98541b9b61bac0e00
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives at
> https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2farchive.midrange.com%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-d8969299e7b0ec928220a8e421d8ba31ed903aa8
> .
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link:
> https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2famazon.midrange.com&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-7bdbc8b1333de5b4f397fba47414609fc62fe2d1
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com