World Class Security Experts. Security Considerations for the IFS

Size: px

Start display at page:

Download "World Class Security Experts. Security Considerations for the IFS"

Sherilyn Atkinson
8 years ago
Views:

1 World Class Security Experts Security Considerations for the IFS Carol Woodbury, President and Co-Founder SkyView Partners, Inc Agenda Why you should care about security in the IFS How security differs between the IFS and OS/400 Tools to manage security in the IFS Auditing and the IFS File shares 2 Copyright SkyView Partners, All Rights Reserved 1

com Agenda Why you should care about security in the IFS How security differs between the IFS and

2 Why Should I Care? More IBM products and third-party apps are implemented in file systems other than QSYS.LIB WebSphere Webservers iseries Access Default access is the equivalent of *PUBLIC *ALL allows inappropriate Directory creation Storage of objects PC backups Movies Music Pictures, etc 3 What is Meant by the IFS 4 Copyright SkyView Partners, All Rights Reserved 2

LIB WebSphere Webservers iseries Access Default access is the equivalent of *PUBLIC *ALL

3 IFS Security Compared to i5/os Security Same Different Authority checking algorithm Has *PUBLIC authority Can use authorization lists and private authorities Authority names *RW vs *CHANGE Ignores QCRTAUT system value Ignores ownership setting in User profile Ignores adopted authority Need to look in different audit fields 5 IFS Authorities Authorities *RW *RW *R *R *W *W * Object *OBJMGT *OBJEIST *OBJALTER *OBJREF *AUTLMGT Data *OBJOPR *READ *ADD *UPD *DLT *EECUTE 6 Copyright SkyView Partners, All Rights Reserved 3

Ignores adopted authority Need to look in different audit fields 5 IFS Authorities Authorities *RW *RW *R *R *W *W * Object *OBJMGT

4 IFS Authorities *RW = Read/Write/Execute (*CHANGE) *RW = Read/Write *R = Read/Execute (*USE) *R = Read *W = Write/Execute *W = Write * = Execute Need: *R to read a file or to list the contents of a directory *W to write to a file or add a file to a directory * to traverse through a directory, e.g., /home/cjw 7 Two sets of authority to manage CHGAUT Change Authority command Note that the command requires a pathname for the OBJ parameter 8 Copyright SkyView Partners, All Rights Reserved 4

5 Two sets of authority to manage WRKAUT Work with Authority command Note: This is the recommended setting for / Data authorities *R, Object authorities *NONE 9 Working with Permissions in iseries Navigator Navigate to the file Right click, choose Permissions 10 Copyright SkyView Partners, All Rights Reserved 5

9 Working with Permissions in iseries Navigator Navigate to the file Right

6 Locking Down the IFS Start at the top - just like OS/400 First secure the directories Directories If required, then further secure the objects within Secure using *PUBLIC authority Groups Authorization lists Private What Authorities to Use? OBJAUT(*NONE) and DTAAUT(*) to traverse all directories in a path OBJAUT(*NONE) and DTAAUT(*R) to the directory to read or list the contents OBJAUT(*NONE) and DTAAUT(*RW) to the directory to create objects into it OBJAUT(*NONE) and DTAAUT(*W) to the directory to rename or delete objects OBJAUT (*OBJMGT) at the object level for objects to copy or rename OBJAUT(*OBJEIST) at the object level for objects to delete IBM directories are generally OK 11 Tools for managing IFS authorities - SECTOOLS SECTOOLS PRTPUBAUT and PRTPVTAUT Note: Use caution when specifying *YES to search subdirectory! 12 Copyright SkyView Partners, All Rights Reserved 6

OBJAUT(*NONE) and DTAAUT(*) to traverse all directories in a path OBJAUT(*NONE) and DTAAUT(*R) to the directory to read or list the contents OBJAUT(*NONE) and DTAAUT(*RW) to the directory to create

7 Managing IFS Access with QPWFSERVER Autl No authority no access to QSYS.LIB file system using Explorer. Ignored when using FTP or ODBC Ships with *PUBLIC *USE 13 Management tools available as is from IBM QRYIFSLIB dumps information such as file size, owner, primary group, etc. to an outfile. CHGOWNALL runs the CHGOWN command on all files and subdirectories in the specified directory. CHGAUTALL runs the CHGAUT command on all files and subdirectories in the specified directory. RNMIFSF renames an invalid file or directory name. DLTIFSF deletes from the IFS a file containing invalid characters. DSPLINK displays the actual location that a symbolic link references. CHGCCSID changes the CCSID on one file or all files in a directory. ATTRIB allows IFS file attributes to be updated from OS/400 without requiring a network drive or PC connection. DELTREE deletes all files, directories, and subdirectories from the parent directory down. Obviously, this one needs to be used with caution. Download from ftp://testcase.boulder.ibm.com/as400/fromibm/apisamples/ifstool.savf 14 Copyright SkyView Partners, All Rights Reserved 7

CHGOWNALL runs the CHGOWN command on all files and subdirectories in the specified directory. CHGAUTALL runs the CHGAUT command on all files and subdirectories in the specified directory.

8 Ignores QCRTAUT system value What authority do newly created objects get? Typically inherits ALL authorities of the directory it s being created into Authorization list, *PUBLIC, private, etc Exceptions: CPYTOSTMF Does not copy private authorities or AUTL *PUBLIC and primary group are set to *ECLUDE Owner has *RW Need to change after the create using CHGAUT creat(), move(), mkdir() APIs where the authority can be specified 15 Managing ownership CHGOWN Change Owner command Note: Replace PRODDATA.FILE in the pathname with *.* and all objects in the library are changed 16 Copyright SkyView Partners, All Rights Reserved 8

private authorities or AUTL *PUBLIC and primary group are set to *ECLUDE Owner has *RW Need to change after the create using CHGAUT creat(), move(), mkdir()

9 Application authorization options Adopted authority is ignored Options: User has authorization through *PUBLIC Individual (private) authority for user or group Primary group authority Authorization list Use one of the swap APIs Profile swap Profile token Set UID or Set GID 17 Swap profile uid and gid APIs SALLY SAL_GRP_1 SAL_GRP_2 SAL_GRP_3 swaps to using qsysetuid() JOE SAL_GRP_1 SAL_GRP_2 SAL_GRP_3 SALLY SAL_GRP_1 SAL_GRP_2 SAL_GRP_3 swaps to SALLY APP_PROF SAL_GRP_2 SAL_GRP_3 using qsysetgid() 18 Copyright SkyView Partners, All Rights Reserved 9

10 Auditing CHGAUD Change Auditing command 19 Audit entries *N in the Object Name field of an audit entry indicates the object is a pathname Pathname is a 5002 character field at the end of the audit journal entry Must use DSPJRN (Display Journal) command to display See iseries Security Reference manual, Appendix F for outfile layout DSPAUDJRNE (Display Audit Journal Entry) does not support pathnames 20 Copyright SkyView Partners, All Rights Reserved 10

(Display Journal) command to display See iseries Security Reference manual, Appendix F for outfile layout

11 Audit entries Key for Reworking Security Make sure *CREATE and *DELETE are specified in QAUDLVL system value Query for objects being created into or deleted out of directories Hint: Query for all objects with *N as the Object Name This tells you what authority is required for the process to write to the directory. *PUBLIC DTAAUT(*ECLUDE) OBJAUT(*NONE) FTPDWNLOAD DTAAUT(*R) OBJAUT(*NONE) FTPUPLOAD DTAAUT(*RW) OBJAUT(*NONE) 21 DSPAUDJRNE DSPAUDJRNE ENTTYP(CO) 22 Copyright SkyView Partners, All Rights Reserved 11

authority is required for the process to write to the directory.

12 DSPJRN CRTDUPOBJ OBJ(QASYCOJ4) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(QTEMP) DSPJRN JRN(QAUDJRN) FROMTIME('09/13/05' '17:30:00') + JRNCDE((T)) ENTTYP(CO) OUTPUT(*OUTFILE) + OUTFILFMT(*TYPE4) OUTFILE(QTEMP/QASYCOJ4) 23 File shares File shares make the directory available to the network Many systems have shared / Manage file shares through iseries Navigator 24 Copyright SkyView Partners, All Rights Reserved 12

OUTFILE(QTEMP/QASYCOJ4) 23 File shares File shares make the directory available to the network Many

13 File shares Navigate to the directory Right click Choose Sharing, New sharing to define a new share A hand underneath the folder indicates a share 25 File shares Shares can be Read only or Read/Write Underlying OS/400 authorities on the object determine what can be done to the file Secure the QZLSADFS (Add file share) and QZLSCHRS (Change file share) APIs 26 Copyright SkyView Partners, All Rights Reserved 13

Underlying OS/400 authorities on the object determine what can be done to the file Secure the QZLSADFS

14 New IFS System Values and Exit Points V5R3 QSCANFS Scan file system *NONE or *ROOTUPOD every stream file in /, QOpenSys and userdefined file systems are scanned Works together the QIBM_QP0L_SCAN_OPEN (Scan on Open) and QIBM_QP0L_SCAN_CLOSE (Scan on Close) exit points to define what program does the scanning. Documented in the API section of the Info Center. QSCANFSCTL Scan file system control parameters Determines which objects and when objects within a file system are scanned (for example scan only when the object is changed.) Determines the action to take when the scan fails. Works together with new attributes on *DIR (*CRTOBJSCAN) and *STMF (*SCAN) 27 Stop Ignoring the IFS Many people are choosing to ignore the security issues residing in the IFS 28 Copyright SkyView Partners, All Rights Reserved 14

QSCANFSCTL Scan file system control parameters Determines which objects and when objects within a file system are scanned (for example scan only when the object is changed.

15 For More Information Experts Guide to OS/400 Security by Carol Woodbury and Patrick Botz, ISBN , 29th Street Press White paper Virus Got you Down? iseries Security Reference manual Appendix D Available from the IBM Information Center at Providing policy management and risk assessment software and security services! 29 Copyright SkyView Partners, All Rights Reserved 15

jsp iseries Security Reference manual Appendix D Available from the IBM Information Center at http://www.iseries.ibm.

Carol Woodbury @carolwoodbury President and Co-Founder SkyView Partners, Inc www.skyviewpartners.com

Carol Woodbury @carolwoodbury President and Co-Founder SkyView Partners, Inc Differences / Likenesses Authorities Scenarios Monitoring authority to root / Finding new directories / objects Monitoring authority