Re: ifs security and qpwfserver autl change gotchas?

Malware that encrypts directories certainty CAN encrypt QSYS.LIB given a share. I’ve seen it done. That boss that insists on that share is misguided to say the least.

I’ve recovered systems that have been attacked. When the reasonable security is placed on shares, and they are monitored properly an attack can be recovered presuming an air gap at some point in the back up scheme, but only with proper prior planing and sound security protocols in place.

Two customers got the entire Microsoft environments clobbered, yet the only IBMi directories that got hit where /home and /www. Since we had good backups, the IBM i was functioning again within a couple of hours. The rest of the network, not so much.

Jim Oberholtzer
Agile Technology Architects

On Jun 1, 2021, at 11:25 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

I agree that sharing the root is a no-no. I would consider using this authorization list "defense in depth", "belt and suspenders" or whatever saying you're used to.
If, however, you have that boss that insists on sharing the root so that some PC based tool can examine your IBM i for malware then you many consider the authorization list vital.

Some say ransomware is a big risk in QSYS.LIB. Others say the encryption won't work on QSYS.LIB objects. Not sure which is true but I'm not about to open the gates to find out. Now maybe creating a share on \QSYS.LIB\ENCRYPTEST.LIB might be worth a test and try encrypting on extensions like .PGM, .FILE, .MBR, .DTAARA, .DTAQ

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Justin Taylor
Sent: Tuesday, June 1, 2021 11:23 AM
To: MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: ifs security and qpwfserver autl change gotchas?

CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.


Personally, I can't think of a legitimate reason to do it. I consider it a
hack.

Sharing the root is considered a huge security threat. Consider ransonware
that runs on a PC and encrypts then deletes files on SMB shares. The
encrypt will fail on native IBMi objects but the delete will succeed.



date: Fri, 28 May 2021 10:18:22 +0200

from: Patrik Schindler <poc@xxxxxxxxxx>
subject: Re: ifs security and qpwfserver autl change gotchas?

Hello Stefan,

Am 27.05.2021 um 22:23 schrieb stefan@xxxxxxxxxx:

Yes, but " By setting Public authority on the QPWFSERVER AUTL to

*EXCLUDE, the users are restricted from accessing QSYS.LIB file system by
these methods

Emphasizing my limited knowledge, is there any point in accessing QSYS.LIB
by "remote" means, like a network share? The objects there are special, no
stream files. I guess, there's nothing within Windows can cope with.

:wq! PoC

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com