• Security Top of Mind as Massive Hacks Continue

  December 4, 2024 Alex Woodie

  The calendar indicates peace and joy, but instead a sense of dread and fear permeates business, as the number and scope of security breaches grows and new regulations loom on the horizon. Ransomware, in particular, is proving itself to be a thorny issue for companies of all sizes, including IBM i shops.

  The latest mega-hack involved Chinse state actors infiltrating the American telecommunications backbone, where they not only accessed huge numbers of call detail records (CDRs) – which they used for counter-espionage purposes – but also read text messages and listened to Americans’ phone calls.

  Known as Salt Typhoon, the …

  Read more

• Guru: Web Concepts For The RPG Developer, Part 4

  October 21, 2024 Chris Ringer

  The final article in this series is about the JWT (JSON Web Token). If you wish to review the previous articles, you can drill back from part three. For unattended machine to machine (M2M) processes, a JWT string is a formatted container for requesting access to a resource server. I think of a resource server as the applications. And in our case, the JWT has an asymmetric signature.

  But really, what is a JWT? It’s similar to a temporary driver’s license. Think about your last visit to a hotel (figure 1).

  Steps:

  1. You present your ID (JWT) during check-in

  …

  Read more

• Guru: Web Concepts For The RPG Developer, Part 3

  July 22, 2024 Chris Ringer

  Greetings everyone. Articles part one and two were both an introduction on how to build components in an HTTP request. In part three, we will begin to connect the dots and discuss how to asymmetrically sign a simple string. If you ever need to send a secure HTTP request to a government agency or financial institution, you likely will authenticate with a signed token. So, here we go!

  Base64 Take Two

  In part one, the SQL scalar function BASE64_ENCODE embedded in RPG converted a string to base64. This technique will cover most use cases, but what if you need …

  Read more

• Guru: Web Concepts For The RPG Developer, Part 2

  June 10, 2024 Chris Ringer

  Hello again! Part 1 of Web Concepts for the RPG Developer was an introduction on how to build components in an HTTP request and I hope you enjoyed it. Part 2 is just a continuation of that vast topic because there is so much to learn. I encourage you to click on the links in this article and explore on your own too.

  JSON

  A web API endpoint may require the data in the body of an HTTP POST request to be constructed as JSON (“jay sahn,” short for JavaScript Object Notation). JSON is formatted text (a string) containing key:value …

  Read more

• IBM i PTF Guide, Volume 25, Number 22

  June 5, 2023 Doug Bidwell

  Welcome back after the Memorial Day holiday, and our thanks to all who have served and who currently serve.

  There is a slew of security issues that you need to deal with on the IBM i platform. So let’s get to it.

  First, we have Security Bulletin: IBM Java SDK and IBM Java Runtime for IBM i are vulnerable to exposing sensitive information due to flaws and configurations (CVE-2023-30441), which you can find out more about here. The vulnerability can be fixed by applying the latest Java Group PTF.  Releases 7.5, 7.4, 7.3, and 7.2 of IBM i will …

  Read more

• Thoroughly Modern: Good Security Is Just As Important As Good Code

  June 13, 2022 Pauline Brazil Ayala

  Can my IBM i really be hit with a virus? Can it be hit with ransomware?

  These are the questions I regularly get from clients as a security expert with more than 20 years of experience. With the pervasiveness of these ransomware threats and sophisticated cyberattacks that we’re seeing in recent times, it only makes sense that we pay close attention to these threats.

  Security on the IBM i is a complex topic, and it is not one that is easily tackled with a few bullet points and tweaks of systems settings. Just like programming on the platform, for that …

  Read more

• Locking Down Exit Point And IFS Vulnerabilities On IBM i

  March 24, 2021 Pauline Brazil Ayala

  It’s true that the IBM i server is among the most securable servers on the planet. But all too often, customers do not take the time to secure their environments properly. This is particularly true for two of the most oft-neglected components of the IBM i environment: exit points and the IFS.

  IBM introduced exit points with the launch of OS/400 V3R1 way back in 1994. We remember that version well here at Trinity Guard, because soon after that, we developed the industry’s first exit point monitoring software for the AS/400 at PentaSafe, the spiritual predecessor of our company. …

  Read more

• Guru: Use The Administration Runtime Expert To Validate Your System Configuration

  June 22, 2020 Dawn May

  Using the Administration Runtime Expert (ARE) to validate system configuration settings is an easy way to confirm configuration values are set the way you want them to be. You can use ARE to ensure these system configuration settings are consistent across multiple IBM i partitions or to verify settings have not changed on an individual partition. In this second in a series of articles on ARE, we’ll walk through the steps to set up a basic template to validate system configuration settings.

  The first step is to identify what system configuration attributes you want to make sure are consistent or …

  Read more

• Guru: Introduction to the Administration Runtime Expert

  June 1, 2020 Dawn May

  Business-critical applications must be up and running reliably without failure. When something unexpected occurs, you must identify the cause and correct it quickly. Whether you’re a developer launching a new application, enhancing an existing application, or maintaining a legacy application, or an administrator managing the infrastructure, we all want to find ways to make our jobs easier, and unexpected surprises are not fun. I expect the relentless push to do more with less is only going to intensify while the tolerance for failure keeps dropping. Yet identifying points of failure can be tricky as complexities scale.

  IBM i offers a …

  Read more

• Guru: Copy From Stream File FMTOPT(*NOCHK)

  April 13, 2020 Bob Cozzi

  Using SQL frequently, as I do, I tend to look for solutions to problems that can be resolved using the database language (i.e., SQL). Sometimes I have to invent a missing piece of the puzzle. Often that entails writing a User-Defined Function (UDF) for use in SQL, but sometimes a CL command is the better choice.

  Recently I had a situation where what the client calls an “EDI File” was being downloaded using sftp on the IBM server running i. This file is created at a vendor that runs IBM mainframes (an actual mainframe by the way) and the file …

  Read more

Previous Articles