Wed, Oct
2 New Articles

Polly, Want a Hacker?

Security - Other
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

When exposing an AS/400 (or any other system, for that matter) to the Internet, you need to pay special attention to security. Proper use of the entire array of AS/400 security tools supplied with OS/400 is required (see “Focus on Security,” MC, May 1998). Set the system security level to 40, change default passwords, turn off autoconfiguration of physical and virtual devices, implement strong passwords and frequent password changes, and disable well-known profiles supplied by IBM (like QSECOFR, QSYSOPR, QPGMR, QSRV, and QSRVBAS). The IBM manual AS/400 Tips and Tools for Securing Your AS/400 V4R4 provides a wealth of information about securing your AS/400.

Also note that a great many Internet security products do not run natively on the AS/400. Rather, these products run on platforms such as the AS/400’s Integrated Netfinity Server (INS) card, outboard PCs, or UNIX servers and provide security services to the AS/400 and other networked systems.

Key Security Services

The National Institute for Standards and Technology (NIST) defines five key security services:

• Authentication is the assurance that the entity at the other end of a connection is what it claims to be. In e-commerce, authentication is a critical service. It is the difference between shipping merchandise to a legitimate customer and sending it to a criminal using a stolen credit card.

• Access control is the assurance that the entity requesting access to a resource (data or a service) is authorized to access that resource. Access control ensures that your customer cannot access a for-fee information service without paying for it first.

• Integrity is the assurance that information is not altered during transmission. Integrity confirms that a hacker has not modified the delivery address in a shipment or altered the price.

• Confidentiality is the assurance that no party other than the intended recipient can intercept information (intentionally or accidentally). Confidentiality services (generally encryption) make the use of credit cards and other forms of payment possible.

• Nonrepudiation (or accountability) is the assurance that a transaction can be proven to have taken place. Nonrepudiation services keep customers from reneging on payment for a stock trade or material order by claiming that they never placed the order.

Your e-commerce security plan should incorporate all five of these services.

E-commerce Network Design

Good e-commerce security starts with good network design. Designing Internet connectivity into your private network generally has multiple—often conflicting—goals, such as the following:
• Allowing users inside your organization’s network to access various Internet resources
• Permitting the exchange of email
• Allowing Internet users access to certain (public or semipublic) resources located within your organization’s network
• Preventing unauthorized access to your private resources by Internet users Even though these are extremely complex goals, you’ll still want the network to be easy to maintain, troubleshoot, configure, and protect. Figure 1 shows a network that is designed with these goals in mind. First, private resources are usually protected behind a firewall. Firewalls are a key component of Internet security. Firewalls filter data flowing between your private network and the Internet. Resources that are intended for public use may be located either inside or outside the firewall. The portion of a network located outside the firewall is called the perimeter network.

In Figure 1, a single server is located in the perimeter network. This server receives inbound Internet requests for Web pages using HTTP or SSL-encrypted HTTP (called HTTPS). This server communicates to the corporate network through the firewall (just like any other Internet-located system) and cannot, of itself, initiate contact with any private resources behind the firewall. Instead, systems behind the firewall may access the public server and initiate requests, or data can be exchanged manually, perhaps by tape transfer.

The resources in the perimeter network are exposed to the Internet and respond to requests from Internet-based users. In this design, Internet users are never allowed to communicate directly with systems located in the private portion of the network. This design affords a high degree of security for those resources located behind the firewall but exposes the public server to a higher degree of risk. You should run only those services (HTTP and HTTPS, for example) that are absolutely required on the public server. Additional measures, such as limiting the number of user profiles, setting complex password rules, and shutting off IP forwarding, can help make your public server much more secure.

Using this type of network design allows the use of restrictive security at the firewall. No Internet users are allowed to initiate contact with systems behind the firewall. The downside to this approach is that e-commerce systems often require immediate access to production data and services, such as current inventory, pricing, or other online information stored in the private network. This design works well, however, when the information located on the public server is relatively static or when daily updates are acceptable.

An alternative is to locate the public server behind the firewall. This configuration creates some exposure for the private network because Internet traffic is allowed to pass in through the firewall. It also places an additional burden on the firewall system because the firewall must now filter all Internet traffic bound for the public server. As you might have guessed, firewall administration is somewhat more complex in this environment. On the plus side, placing the public server behind the firewall and strictly limiting the type of requests allowed through the firewall can reduce the security risks of connecting the public server to production machines where a direct connection is required.

Ring of Fire

The network design that we just discussed relies on a firewall to filter network traffic between the private network and the Internet. Firewalls provide a single point from which to control access between the private network and the Internet. Many firewalls are on the market. Most run on dedicated platforms, UNIX variants, or Windows NT and can contain both software and hardware elements. The IBM Firewall for AS/400 runs on a dedicated INS (formerly known as the IPCS and the FSIOP) that runs a special trimmed-down version of OS/2. The IBM manual Getting Started with IBM Firewall for AS/400 V4R4 has an excellent overview of firewalls and how they work (even if you don’t intend to use the product).

The IBM Firewall for AS/400 has a significant drawback (at least when compared to dedicated firewalls): When the AS/400 goes down or the QSYSWRK subsystem is ended, the firewall shuts down and no traffic can pass between the private and public networks. This is a significant drawback if you plan to run the IBM Firewall for AS/400 on a production box that is taken down regularly for backups and IPLs. In this environment, a dedicated firewall might be a better answer. Popular firewall products—like Network Associates’ Gauntlet, Check Point Software Technologies’ FireWall-1, AXENT Technologies’ Raptor Firewall, and Secure Computing’s Sidewinder Security Server—that run primarily on UNIX variants or NT might prove a better fit in many environments.

Most firewalls hide information about your network, such as IP addresses and operating systems, from Internet users and block certain types of transmissions from entering or leaving your network. Some firewalls log information about various types of inbound and outbound activity, encrypt and decrypt information to keep it secret, and authenticate Internet users allowed past the firewall.

Firewalls use several techniques to hide information about your network from Internet users. In an IP transmission, every packet of data contains a source and destination address. If an Internet user has the address of one of your Internet-connected private systems, that user can attempt to start various services directly on that system. In order to prevent this from happening, the firewall uses either a proxy application or a network address translation (NAT) to convert IP addresses in your private system to the address of the firewall itself or to one of a pool of special addresses reserved for translation purposes.

Figure 2 illustrates NAT. A client ( in the private portion of the network initiates a request to an Internet-based host system ( NAT at the firewall causes the address of a firewall-assigned address ( to be sent as the originating address. As a result, Internet hosts never see the actual IP addresses of systems located within the private network—they see only the address of the firewall. This keeps details of private network structure a secret from Internet users. An additional benefit of NAT is that systems located on the private side of the firewall do not need Internet-routable IP addresses. It can be difficult (and expensive) to obtain large blocks of Internet addresses, so this scheme provides multiple benefits for larger organizations. As of V4R4, OS/400 provides native support for certain firewall-like functions, including NAT and IP filtering.

Don’t Be So Insecure

In order to protect the information your customers send to you over the Internet, you need to implement some sort of encryption technology. Currently, Secure Sockets Layer (SSL) is the most popular form of encryption in use on the Web. SSL (see “Technology Spotlight: An Anatomy of SSL,” MC, August 1998, for details) allows two systems to establish a secure, encrypted session that makes eavesdropping difficult, if not impossible. SSL comes in three basic strengths: 40-bit SSL, which uses a 40-bit encryption key; 56-bit SSL; and 128-bit SSL. Specialized decryption systems can decode 40-bit SSL in less than three hours. Far more secure is 128-bit SSL. When using SSL, specialized encryption hardware is sometimes used to offload the encryption/decryption chore. (In August, IBM announced the 4758 Cryptographic Coprocessor for the AS/400 for just this reason.)

SSL support is built into the IBM HTTP Server for AS/400 (formerly Internet Connection Server). Many other platforms provide SSL support, including Internet Information Server (IIS) on Windows NT, as do popular Web browsers (including Microsoft and Netscape browsers). Significant improvements to SSL support were introduced in OS/400 V4R4, including support for SSL encryption of Telnet sessions and most Client Access Express functions.

Encryption alone, however, is not enough. In addition to establishing secure communications with your customer, you need to verify that it is, indeed, your customer at the other end of the line. Your customer, on the other hand, needs to be sure that she is really sending her credit card information to you and not to some Internet impostor. Finally, you need some way to prove that the order was really placed by that specific customer for the number and price ordered.

Do You Have Some Identification?

Remember our NIST security services: authentication, access control, integrity, confidentiality, and nonrepudiation. You have already seen how firewalls (plus operating system features like passwords and object authority) provide access control and some measure of authentication. Encryption techniques like SSL provide confidentiality and a higher degree of data integrity. Certificate Authorities (CAs), digital certificates, and digital signatures provide enhanced authentication and integrity, plus nonrepudiation.

Digital certificates are the Internet equivalent of passports or other forms of positive identification. Digital signatures, as the name states, provide the digital equivalent of a signature. CAs are trusted entities (governments, financial institutions, or other entities) that verify the identity of Internet users and issue digital certificates. You can even become a CA yourself. (Many organizations do, at least for the purpose of issuing internal digital certificates to employees and customers.) Digital certificates and digital signatures rely upon public key infrastructure (PKI) encryption techniques. You would generally apply to a third-party CA like VeriSign (www.verisign.com) for a digital certificate for your e- commerce server. Users connecting to your server could verify the certificate with the CA and then be able to rest assured that they are really communicating with your organization. Your customer would apply to a CA (either a third party or you) and, after providing satisfactory identification, receive a digital certificate with a corresponding public and private key. The public key is used to encrypt information that is sent to the customer. The customer’s private key is the only way to decrypt a transmission encrypted with the public key.

A digital signature is “signed” by the holder of a certificate using the private key. The signature is sent to the other party, and the public key is used to decrypt the signature and verify that it actually came from the indicated sender.

In order to use SSL and digital certificates, you need to install TCP/IP Connectivity Utilities for AS/400 and the IBM HTTP Server for AS/400. You must also install one of the cryptographic access provider licensed programs (5769-AC1, 5769-AC2, or 5769- AC3) to create certificate keys. These products determine the maximum key length permitted for cryptographic algorithms.

In order to issue and track issued digital certificates, you will need to install IBM Digital Certificate Manager for AS/400 or a third-party solution, like Entrust/PKI (Windows 95/98/NT, Solaris, AIX, and HP-UX).

Email Security and Viruses

E-commerce inevitably means increased inbound and outbound Internet email. Two big email security concerns need to be addressed: computer viruses (inbound and outbound) and confidentiality.

Good, automated virus checking of inbound email is essential. Inbound mail gateways should be protected by server-resident virus protection software. User

workstations should have virus protection software in place. All virus protection software should be updated with new virus signatures on a regular basis. Viruses can be used to compromise network security and to wreak general havoc within your network.

Symantec’s Norton AntiVirus product line includes products for Windows clients and servers, Macintosh, Lotus Notes, Microsoft Exchange, OS/2, NetWare, DOS, firewalls, and Internet email gateways. Regular virus updates are available for download from the Symantec Web site (cafe.symantec.com).

The vast majority of Internet email is sent unencrypted. Email often traverses a number of systems before arriving at its final destination. Business email is likely to include information of a confidential nature: passwords, account numbers, prices, salaries, and personnel information. Email snooping is a popular pastime with some network administrators and Internet Service Providers (ISPs).

A simple solution is email encryption. A number of inexpensive (or free) email encryption solutions solve the problem of email snooping. Microsoft Outlook offers native encryption after you sign up for a digital certificate with a public provider. Network Associates offers Pretty Good Privacy (PGP) in both freeware and supported product implementation. In spite of the name, PGP is secure and widely used. Email encryption uses the same sort of public key cryptography used in SSL. The sender encrypts to the other recipient’s public key. The recipient decrypts using the private key. PGP works with a number of popular email clients.

Be Afraid, Be Very Afraid

Once all of your defenses are in place and your e-commerce system goes live, detection of potential penetration attempts and other security events becomes a significant concern. OS/400 provides a number of excellent tools for monitoring security-related events, including security audit journaling. Firewalls may also provide monitoring capabilities.

Network scanning and activity-monitoring software is designed specifically to help you identify potential threats and to determine exactly what happened in the event of a security breach. Atlanta-based Internet Security Systems (www. iss.net) develops network scanning and intrusion detection software for just this purpose. Network-scanning software allows you to probe your own network for the same sort of vulnerabilities that hackers look for. Intrusion detection software attempts to detect security breaches and provides notification and automated response.

The Internet can be a scary place. Put strong security in place and stick to a rigid security policy. Operate under the assumption that your defenses will be tested—odds are that they will. Be prepared to detect intrusion attempts and deal with them.

Public server Perimeter network Firewall Router


Figure 1: Here's how to connect a private network to the Internet.

Internet host

sees requests as coming from

User's PC

Production AS/400

Production NT server

HTTP Request

Internet user


Production AS/400

Private network



User's PC

Figure 2: Check out this diagram of how NAT works.


Firewall assigns address to for this session

Perimeter network



Support MC Press Online

$0.00 Raised:

Book Reviews

Resource Center

  • SB Profound WC 5536 Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application. You can find Part 1 here. In Part 2 of our free Node.js Webinar Series, Brian May teaches you the different tooling options available for writing code, debugging, and using Git for version control. Brian will briefly discuss the different tools available, and demonstrate his preferred setup for Node development on IBM i or any platform. Attend this webinar to learn:

  • SB Profound WP 5539More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.

  • SB HelpSystems ROBOT Generic IBM announced the E1080 servers using the latest Power10 processor in September 2021. The most powerful processor from IBM to date, Power10 is designed to handle the demands of doing business in today’s high-tech atmosphere, including running cloud applications, supporting big data, and managing AI workloads. But what does Power10 mean for your data center? In this recorded webinar, IBMers Dan Sundt and Dylan Boday join IBM Power Champion Tom Huntington for a discussion on why Power10 technology is the right strategic investment if you run IBM i, AIX, or Linux. In this action-packed hour, Tom will share trends from the IBM i and AIX user communities while Dan and Dylan dive into the tech specs for key hardware, including:

  • Magic MarkTRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now!  Request Now.

  • SB HelpSystems ROBOT GenericForms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.

  • SB HelpSystems ROBOT GenericIT security is a top priority for businesses around the world, but most IBM i pros don’t know where to begin—and most cybersecurity experts don’t know IBM i. In this session, Robin Tatam explores the business impact of lax IBM i security, the top vulnerabilities putting IBM i at risk, and the steps you can take to protect your organization. If you’re looking to avoid unexpected downtime or corrupted data, you don’t want to miss this session.

  • SB HelpSystems ROBOT GenericCan you trust all of your users all of the time? A typical end user receives 16 malicious emails each month, but only 17 percent of these phishing campaigns are reported to IT. Once an attack is underway, most organizations won’t discover the breach until six months later. A staggering amount of damage can occur in that time. Despite these risks, 93 percent of organizations are leaving their IBM i systems vulnerable to cybercrime. In this on-demand webinar, IBM i security experts Robin Tatam and Sandi Moore will reveal:

  • FORTRA Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:

  • FORTRAManaging messages on your IBM i can be more than a full-time job if you have to do it manually. Messages need a response and resources must be monitored—often over multiple systems and across platforms. How can you be sure you won’t miss important system events? Automate your message center with the Robot Message Management Solution. Key features include:

  • FORTRAThe thought of printing, distributing, and storing iSeries reports manually may reduce you to tears. Paper and labor costs associated with report generation can spiral out of control. Mountains of paper threaten to swamp your files. Robot automates report bursting, distribution, bundling, and archiving, and offers secure, selective online report viewing. Manage your reports with the Robot Report Management Solution. Key features include:

  • FORTRAFor over 30 years, Robot has been a leader in systems management for IBM i. With batch job creation and scheduling at its core, the Robot Job Scheduling Solution reduces the opportunity for human error and helps you maintain service levels, automating even the biggest, most complex runbooks. Manage your job schedule with the Robot Job Scheduling Solution. Key features include:

  • LANSA Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.

  • LANSAWhen it comes to creating your business applications, there are hundreds of coding platforms and programming languages to choose from. These options range from very complex traditional programming languages to Low-Code platforms where sometimes no traditional coding experience is needed. Download our whitepaper, The Power of Writing Code in a Low-Code Solution, and:

  • LANSASupply Chain is becoming increasingly complex and unpredictable. From raw materials for manufacturing to food supply chains, the journey from source to production to delivery to consumers is marred with inefficiencies, manual processes, shortages, recalls, counterfeits, and scandals. In this webinar, we discuss how:

  • The MC Resource Centers bring you the widest selection of white papers, trial software, and on-demand webcasts for you to choose from. >> Review the list of White Papers, Trial Software or On-Demand Webcast at the MC Press Resource Center. >> Add the items to yru Cart and complet he checkout process and submit

  • Profound Logic Have you been wondering about Node.js? Our free Node.js Webinar Series takes you from total beginner to creating a fully-functional IBM i Node.js business application.

  • SB Profound WC 5536Join us for this hour-long webcast that will explore:

  • Fortra IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn: