Re: Penetration testing IBMi 7.3?

Thanks for the advice.

The box in question just had a brand new IBM i-7.3 installation performed
and all the latest PTF s applied. This was done by IBM.

The rest of the work to bring the system back to production status is to
load back all the backups taken from a IBM i7.1 installation which are only
the application libraries and data.

I would imagine now the system is in a fairly safe state but I could
certainly ask the vendor to look at the recommendations you make below.

On Wed, Jul 22, 2020, 9:04 AM Steinmetz, Paul via MIDRANGE-L <
midrange-l@xxxxxxxxxxxxxxxxxx> wrote:

Laurence,

I would start by testing the areas that do break on OS and/or PTF applies.
We've had issues with all of the below.

FTP
SFTP
SSH
SSL (ciphers, certs, etc)
All/any email sent from IBMi LPAR
Compiles to previous release
Run IBM pre-upgrade verification tool - run_pruv.bat
Any OS upgrade V6R1, V7R1, V7R3 changed public authority from *USE to
*EXCLUDE for system object QPMLPMGT. This object is used to confirm license
product information.

Paul



-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Laurence Chiu
Sent: Tuesday, July 21, 2020 1:01 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Penetration testing IBMi 7.3?

We arevmoving a production system from one data centre to another. There
will be prod in one, DR in the second. The application is pure RPG on IBMi
with green screen access., There is no web application. The Power servers
are behind application firewalls and the only external access to the
servers is via the corporate VPN.

There is discussion that we need to perform penetration testing but I
cannot work out what that scope might be. We do have web based applications
but they don't talk to IBMi at all. The closest we have are some web based
applications that grab balances from a mainframe application using MQ
messaging and then the CICS transaction might send a message to the IBMi
application over MQ to get a balance from another system.

I guess we could ask our pen testing organisation to start with the IP
address of the application web server and then see if they can somehow get
to the IBMi server console but that seems very tricky since the IBMi box
isn't advertising any services and supports only 5250 access, MQ and
Correct:Direct.

Anybody in a similar position can provide some insight? Thanks
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2flists.midrange.com%2fmailman%2flistinfo%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-ed24f2b9db01e7fd1593f4c98541b9b61bac0e00
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2farchive.midrange.com%2fmidrange%2dl&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-d8969299e7b0ec928220a8e421d8ba31ed903aa8
.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link:
https://smex-ctp.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2famazon.midrange.com&umid=42884ad4-707b-4ecf-892e-14f997492888&auth=438b0784514c1757bd202125ca4db8b0abdb021e-7bdbc8b1333de5b4f397fba47414609fc62fe2d1
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com