Re: ifs security and qpwfserver autl change gotchas?

Same with the deletion of files and members. /QSYS.LIB is just another IFS path.

Could blast your classic source files pretty quickly.

Regards,
Richard Schoen
Web: http://www.richardschoen.net
Email: richard@xxxxxxxxxxxxxxxxx
------------------------------

message: 2
date: Tue, 1 Jun 2021 12:32:48 -0500
from: Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx>
subject: Re: ifs security and qpwfserver autl change gotchas?

Malware that encrypts directories certainty CAN encrypt QSYS.LIB given a share. I?ve seen it done. That boss that insists on that share is misguided to say the least.

I?ve recovered systems that have been attacked. When the reasonable security is placed on shares, and they are monitored properly an attack can be recovered presuming an air gap at some point in the back up scheme, but only with proper prior planing and sound security protocols in place.

Two customers got the entire Microsoft environments clobbered, yet the only IBMi directories that got hit where /home and /www. Since we had good backups, the IBM i was functioning again within a couple of hours. The rest of the network, not so much.

Jim Oberholtzer
Agile Technology Architects

On Jun 1, 2021, at 11:25 AM, Rob Berendt <rob@xxxxxxxxx> wrote:

?I agree that sharing the root is a no-no. I would consider using this authorization list "defense in depth", "belt and suspenders" or whatever saying you're used to.
If, however, you have that boss that insists on sharing the root so that some PC based tool can examine your IBM i for malware then you many consider the authorization list vital.

Some say ransomware is a big risk in QSYS.LIB. Others say the
encryption won't work on QSYS.LIB objects. Not sure which is true but
I'm not about to open the gates to find out. Now maybe creating a
share on \QSYS.LIB\ENCRYPTEST.LIB might be worth a test and try
encrypting on extensions like .PGM, .FILE, .MBR, .DTAARA, .DTAQ

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com