• White Hats Completely Dismantle Menu-Based Security

  February 6, 2023 Alex Woodie

  Think menu-based security can prevent cybercriminals from accessing the most important parts of your IBM i system? Think again, as the white hat hacking group Silent Signal recently demonstrated in a real-world penetration test of a bank’s IBM i system through a seemingly restricted green-screen interface.

  Life was demonstrably simpler for midrange administrators before the Internet took off. Before we had all these different protocols providing access to applications and data – ODBC, FTP, SQL, Remote Command, etc. – an administrator could feel somewhat confident that users weren’t accessing things they shouldn’t by simply configuring their menus in a restrictive …

  Read more

• IBM i PTF Guide, Volume 25, Number 4

  January 23, 2023 Doug Bidwell

  Here are some reminders to start off the IBM i PTF Guide this week.

  First, there are new releases for Access Client Solutions and the ODBC database driver. (See ACS_NAV in the Guide for the links.) The funny bit – funny odd, not funny hilarious – is that version 26 of ACS did not allow companies to create a database source for ODBC, which is serious shortcoming. Now, there is a new version 27 that will let you do it. Here is the updated software:

  Description				   Version
  IBM i Access Client Solutions (1.1.9.1)	   1.1.9.1
  ACS Windows App Pkg English (64bit)	   

  …

  Read more

• IBM and Microsoft Bring .NET to Power, After All

  November 9, 2022 Alex Woodie

  Despite initially denying the existence of a project to bring the Microsoft .NET runtime to Power, IBM this week officially announced that .NET version 7 will run on Red Hat Enterprise Linux on Power. The technology becomes available immediately, although the database driver connecting .NET applications to Db2 for i will take more time.

  Over the years, there have been various attempts at getting the .NET runtime unhooked from its Windows roots and replanted on the Power platform, including some targeting the IBM i operating system. In 2011, a big step forward was made with the Mono Project, which …

  Read more

• IBM Unveils Fall 2022 Tech Refreshes for IBM i

  October 12, 2022 Alex Woodie

  IBM yesterday announced Technology Refreshes for its two most current IBM i operating systems, including 7.5 and 7.4. Security continues to be a big driver of new functionality with 7.5 TR1 and 7.4 TR7. But the fall TRs bring a bevy of enhancements across all areas, including the database, IBM i services, open source, application development, and analytics, among others.

  Security has been the number one concern for CIOs for a few years now, and IBM has responded with a number of new features in IBM i. Some of the new security features exist in IBM i Navigator, the GUI …

  Read more

• Kyndryl Wants to Connect Your IBM i to Microsoft Azure

  October 12, 2022 Alex Woodie

  Kyndryl, the former IBM division known as Global Technology Services (GTS), last week unveiled an expanded partnership with Microsoft that will see it helping IBM i and System z customers integrate their applications and data with Microsoft Azure, specifically its low-code, no-code development platform called Power.

  Kyndryl’s alliance with Microsoft will make it easier for companies to leverage the valuable data and business logic contained in their midrange and mainframe assets as they develop new applications in the Microsoft Power Platform, which is a low-code, no-code development environment.

  “Basically, it provides a low-code, no-code environment in Azure for programmers,” …

  Read more

• IBM i PTF Guide, Volume 24, Number 35

  August 29, 2022 Doug Bidwell

  Hello good people of IBM i Land. To start off, a reminder that the Memo To Users for supported releases were last updated April 2022. Clients should review the full “What’s New” details to understand recent changes and impact these may have. See the Links tab in the guide to access the Memo for your release, and, check periodically. these should be considered living documents, meaning, they evolve over time, and as such, read frequently!

  Also, ADMIN2 is back at 7.5! IBM turned it off at earlier releases to mitigate the log4j vulnerability in those releases. At V7R5 GA, the …

  Read more

• No Plan To Bring .NET To Power, IBM Says

  July 25, 2022 Alex Woodie

  IBM says it currently has no new projects underway to get .NET to run on Power, which IT Jungle previously reported was a project that was underway at IBM. What’s more, existing efforts to run .NET applications on IBM i that have been backed by Big Blue have apparently drawn very little interest from the vendor community.

  Back in March, we reported on a plan within IBM to get .NET running in a containerized Red Hat Linux and OpenShift environment running on Power, much the same as it had done with System z. Our source told us the project involved …

  Read more

• Reader Feedback On Guru: The Finer Points of Exit Points

  July 12, 2022 Bruce Bading

  Hey, Alex:

  Hope you are doing well. I was reading this article about exit points and found some technical inaccuracies.

  The Socket Exit can be used to cover the following: You can use exits block all unwanted ports blocked. I will be happy to talk with author of this article to explain how this works.

  • Not all services have exit points available.
  • User defined ports do not have exit points associated.

  Best regards,

  — Tony Perera, Trinity Guard, a division of Fresche Solutions

  ---

  Hey, one and all:

  As the article states, exit points are an enhancement to cybersecurity on the …

  Read more

• Guru: The Finer Points of Exit Points

  June 27, 2022 Bruce Bading

  Many years ago, we received a call from an IBM i customer stating that all exit points were gone and the QAUDJRN and receivers were missing. Then the question, “Do you think we’ve been hacked?” Truth was, the exit points weren’t gone; the associated programs had been de-registered. Conclusion, they had most likely been compromised.

  The IBM i platform is a very securable system that can be secured (Secure vs Secured – What’s the difference?, WikiDiff), if you take steps to secure it.

  On the IBM i, a limited number of functions provide an exit so that your …

  Read more

• IBM i PTF Guide, Volume 24, Number 16

  April 20, 2022 Doug Bidwell

  It is a new week, and there are two new security vulnerabilities in the IBM i platform. First, there is Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is vulnerable to spoofing and clickjacking attacks due to swagger-ui (CVE-2018-25031, CVE-2021-46708), which you can read more about here. The IBM i PTF numbers containing the fix for the CVEs:

  IBM i Release      5770-SS1 PTF Number      PTF Download Link

  7.4                          SI78971                                https://www.ibm.com/support/pages/ptf/SI78971

  7.3                          SI78972                                https://www.ibm.com/support/pages/ptf/SI78972

  7.2                          SI78973                                https://www.ibm.com/support/pages/ptf/SI78973

  Then there is Security Bulletin: OpenSSL for IBM i is vulnerable to a denial of service due to a flaw in …

  Read more

Previous Articles Next Articles