29
Fri, Nov
0 New Articles

Getting Started with IBM i Security

IBM i (OS/400, i5/OS)
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Carol describes the basics of IBM i security and explains how to manage IBM i security using Navigator for i.

If you need a refresher on IBM i security, are just starting out on this adventure, or need a tutorial on using Navigator for i to manage your security settings, this article’s for you! I realized that with new administrators and/or auditors being introduced to the system all the time, I needed to step back from my deeply technical articles and provide guidance on getting started. So here we go.

IBM i security consists of three areas that you’ll want to understand and manage: global settings (called system values), identities or users (called user profiles), and access controls (called object-level security). I liken these areas to legs of a three-legged stool. If one is shorter than the others, you’ll topple over when you sit on the stool. Likewise with IBM i security. If one area is left wide open, it doesn’t matter that the other two have been set to the most restrictive settings; your security objectives cannot be met. These three areas must be in balance for you to achieve your security objectives. Let’s start this discussion with the global settings.

System Values

Many system values exist to control IBM i. There are date/time, storage, language, job, and network configuration-related settings to name a few of the categories in addition to security-related settings. The easiest way to examine the security-related system values is to launch Navigator for i

via the URL http://your-system-name:2002/Navigator/login, click the padlock icon, and choose Security Configuration Info. This view provides a list of all global security-related values, the current value, all possible values, and a description as shown in Figure 1.

Getting Started with IBM i Security - Figure 1

Figure 1: Click on the padlock icon and choose Security Configuration Info.

If you ever need to modify one of these global values, go to the clipboard icon and click on System Values. A list of system value categories is displayed. Beware that this is a list of all system value categories, not just those that are security-related. In Figure 2, I clicked on the Auditing category. From this window, I can manage all of the system values related to logging (called auditing on IBM i.) This interface shows a more readable version of the settings as well as the name of the setting used by the green-screen environment. You might find this handy if you’re moving between the two interfaces.

Getting Started with IBM i Security - Figure  2 

Figure 2: Click on the clipboard icon and choose the category of System Value to display or modify.

User and Group Profiles

The second “leg” of IBM i security to address are users and the sub-category of group profiles. Float down to the people icon and you can choose to create a new user or group or work with a list of user profiles or group profiles (see Figure 3).

Getting Started with IBM i Security - Figure  3 

Figure 3: Click on the people icon to work with user or group profiles.

When creating a new user or group, you can create it from scratch or base it on a model profile. I prefer to create a model profile that represents each role in the organization and base new profiles on the appropriate role. That way, I have all of the details of the profile’s configuration already defined and I don’t have to think about them when creating a new profile. As you’ll see when you go to create a user profile, there are many configuration options, but I’m going to focus on four:

  • Prior to IBM i 7.5, the password defaults to be the same as the user profile name. Make sure you change the password to a strong password and check the box that will cause the user to change the password upon first use. (At IBM i 7.5, the profile defaults to not have a password, which means the profile cannot be used for signon until assigned a password.)
  • Special authorities should only be assigned if the user needs the capability provided by the special authority. Of special concern is the special authority called All object access (or *ALLOBJ in the green-screen environment). Users assigned this value have all authority to all objects on the system (files, libraries, directories…everything!). Obviously, this authority should be granted only to administrators. Developers will claim they need this authority, but don’t be fooled! They do not! And obviously, end users have no business being assigned this capability.
  • Group and supplemental group profiles are the means IBM i provides for placing users in a role. I create a group profile that represents a role (much like the model profile described previously) and assign all special authorities to that role. Then, when a new profile is assigned, they will automatically inherit the special authorities of the role. Profiles can be a member of up to 16 group profiles.
  • The limited capability setting determines whether the profile has the ability to run commands should they get access to a command line. It only has meaning in the green-screen environment but should be applied to end users because they should not be able to run all commands.

To work with existing users and groups, click on the appropriate category to see the list. You can filter to see a specific user/group or profiles with a specific setting, such as those assigned All Object. If you need to display or investigate an attribute that’s not displayed, simply click on the three vertical dots in the upper right of the display. From there you can add or remove columns to display only the attributes you want in the order you want. If you have the correct attributes but don’t like the order, simply drag and drop the columns to achieve the view that suits your analysis. If you prefer working with SQL, click on “SQL” in the upper right and the SQL will be displayed so you can copy and paste it into a Run SQL Scripts window. See Figure 4.

Getting Started with IBM i Security - Figure  4 

Figure 4: Many options are available to customize the list of profiles displayed.

Object-Level Security

The final leg of our IBM i security three-legged stool is access control, or object-level security. For a process to run successfully, the user currently running the process must have sufficient authority to perform the action on the object being accessed. The actual authority required has been architected at the microcode (Machine Instruction) level. Objects can be contained in a library or a directory. Libraries are the original “containers” and hold most of the object types on the system. Directories were added back in the Version 3 days, when there was an effort to migrate UNIX applications to the system. Because libraries are single level (that is, you can’t have a library in a library), a true directory structure needed to be added; thus the Integrated File System (IFS) was born. Regardless of where an object resides, the authority requirements are the same. What’s different and what confuses many is that the permission terminology for objects in libraries is different than that of directories. You’ll see that reflected in the Navigator for i displays.

To manage the permissions of an object in a directory, click on the file folder icon and choose Integrated File System. Navigate to the directory containing the object, right-click, and choose Permissions, as shown in Figure 5.

Getting Started with IBM i Security - Figure 5

Figure 5: Right-click on the object and choose Permissions to set who has authority to access the object.

To manage permissions for objects in libraries, I’ve found that the fastest way to manage authorities is by using either the Schema or Integrated File System feature in Access Client Solutions (ACS). (Let me be totally honest. The Integrated File System section of Navigator for i is still a bit of a work in progress. It will be my preferred method once a few kinks are worked out.) Using the Integrated File System feature, I can specify the library using a pathname, such as /QSYS.lib/prod_lib.lib. This lists the objects in the library. I can then right-click, choose Permissions, and get to the display as shown in Figure 6.

Getting Started with IBM i Security - Figure 6 

Figure 6: Use the Integrated File System feature of ACS to manage permissions on the objects in a library.

For examples of using SQL to manage object permissions, see my previous article “Using IBM i Services to Manage Object Authority Settings.”

Summary

I hope you’ve found this tutorial useful. You’ll find that the security concepts for IBM i are the same as for any other platform, but the terms and implementation are definitely different. For a complete discussion of IBM i security, see my book IBM i Security: Administration and Compliance, Third Edition. And to manage IBM i security using modern interfaces such as SQL and Navigator for i, see my just-released companion book, Mastering IBM i Security.

 

Carol Woodbury

 

Carol Woodbury is IBM i Security SME and Senior Advisor to Kisco Systems, a firm focused on providing IBM i security solutions. Carol has over 30 years’ experience with IBM i security, starting her career as Security Team Leader and Chief Engineering Manager for iSeries Security at IBM in Rochester, MN. Since leaving IBM, she has co-founded two companies: SkyView Partners and DXR Security. Her practical experience and her intimate knowledge of the system combine for a unique viewpoint and experience level that cannot be matched.

Carol is known worldwide as an author and award-winning speaker on security technology, specializing in IBM i security topics. She has written seven books on IBM i security, including her two current books, IBM i Security Administration and Compliance, 3rd Edition and Mastering IBM i Security, A Modern, Step-by-Step Approach. Carol has been named an IBM Champion since 2018 and holds her CISSP and CRISC security certifications.


MC Press books written by Carol Woodbury available now on the MC Press Bookstore.

IBM i Security Administration and Compliance: Third Edition
Don't miss the newest edition by the industry’s #1 IBM i security expert.
List Price $71.95

Now On Sale

Mastering IBM i Security Mastering IBM i Security
Get the must-have guide by the industry’s #1 security authority.
List Price $49.95

Now On Sale

BLOG COMMENTS POWERED BY DISQUS

LATEST COMMENTS

Support MC Press Online

$

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: