FirewallTM. isecurity. Out-of-the Box. The Network Security Component of. Version 15. Copyright Raz-Lee Security Ltd.

Transcription

1 FirewallTM The Network Security Component of isecurity Out-of-the Box Version 15 Copyright Raz-Lee Security Ltd. Updated: 02/09/2011

2 This guide is intended to provide as a quick beginning to the principal features of Firewall. Please refer to the User Manual for detailed procedures and explanations. For installation procedures, see the isecurity Installation Guide. Overview Firewall is a truly comprehensive network security solution that completely secures your iseries against all known external threats, and also controls what users are allowed to do after access is granted. Setting Initial Firewall Security 1. From the type STRFW and press Enter twice. The Firewall main screen appears. Firewall Main Screen 2. Select option 81. System Configuration and press F22 to insert the authorization code. 3. Set Firewall to *FYI ( For Your Information = simulation mode) by selecting 1. Activation and Server Setting > 11. Set *FYI (Simulation) from the Activation screen. 4. Select Y from the Work in *FYI* Simulation Mode field. 2

3 Work in *FYI* Simulation Mode 5. In order to gather activity data for subsequent analysis, enable protection for all servers and enable logging of all transactions into the activity log. Select option 1. Activation and Server Setting form the main menu, and 1. Work with Servers from the Firewall main screen. 6. Select F22=Global Setting from the Work with Server Security screen. The Global Server Security Settings screen appears. 7. Set the Global Server Security Settings screen to the following: Exit point group...*all Secure...*YES Check...*MAX IP/SNA address firewall...*no Log...*YES Allow Action to react... Skip Other exit points...*yes 3

4 Global Server Security Settings 8. If other software was installed prior to this (identify this by seeing Other under the column Security on the previous list of servers), and you want to replace it, make sure the last item is set to *YES. 9. Star marked servers (such as FTP and File Server) will require restarting host server or IPL in order for the security changes to effect fully. This can be delayed until next IPL. The following alert will prompt, asking whether to restart the servers now Special Instructions 10. Wait one day to a week for the Firewall log to generate data. NOTE: When QSERVER is restarted, NETSERVER will be restarted automatically if it was active. 4

5 User Security User security rules control access to server functions by individual users, profiles groups and Firewall user groups. You may also grant users *ALLOBJ (all objects security) for native OS/400 and IFS objects as a part of this definition. To work with user-to-service security, select 11. Users and Groups from the main menu. The Work with User Security screen appears. Work with User Security Press F6 to add a new user to the list and set security definitions for him. Press F7 to create Firewall user groups to simplify the process of creating rules for many different users. Firewall user groups are separate from OS/400 profile groups. To create Time Groups, select 49. Time Groups from the main menu. Add Time Group 5

6 Object Security Object security controls access to objects originating from specific external sources such as FTP, ODBC, etc. You may define specifically which operations and external users allowed to perform on these objects. Rules may be defined for the following object types: files, libraries, data queues, printer files, programs, commands and IFS objects. Firewall can restrict a user s ability to perform specific actions, such as read, write, create, delete, rename, run, etc., on protected objects. Working with Native OS/400 Objects 1. Select 21. Native AS/400 Objects from the main menu. 2. Select an object type from the Object Security menu and then elect an existing rule to modify or add a new rule. Native AS/400 Objects Security Firewall supports exceptions to command restrictions. Use option 9. Command Exceptions on the Object Security menu to work with this feature. Working with IFS Objects 1. Select 22. IFS (QDLS,NFS,QOpenSys...) from the main menu. 2. To set definitions select option 1. IFS Object Usage the Work with IFS Security screen appears. 3. Select an existing rule to modify or press F6 to add a new rule. 6

7 Work with IFS Security Working with Logon Security Logon security rules define logon attributes for specific combinations of IP addresses (or SNA names) and user profiles. In addition, logon security rules can control what a user is permitted to do subsequent to logon Working with Firewall Logs The activity log provides complete details of every transaction captured by a security rule. 1. Select 43. Log, Reports, Queries from the main menu. The Reporting screen appears. Reporting 7

8 Query Wizard 1. Select 1. Work with Queries to choose one of the many pre-defined queries from the Reporting menu Work with Queries 2. Type 1=Select to modify 3=Copy or 5=Run to run the query interactive, 8= Run as batch job or 6=Print: Select preferred Output file type (*PDF, *HTML, *CSV ) and press Enter Log Type address in the Mail to field. Press Enter to run the print Run Firewall Query 1. Select 19. Select from Menu from the Reporting menu, to choose one of the many pre-defined log display options. 8

9 Display Firewall Log 2. Enter run-time filter and other parameters on the Display Firewall Log screen. 3. Press Enter to display the Activity Log. 4. Press F10 view more details, F6 to modify the applicable rule based on an entry in the log. The rule definition screen for the applicable rule type opens. 5. To view the details of an individual entry, move the cursor to the desired line and press Enter or F11. Advanced Security Features You may create several different types of advanced security rules, such as: DDM/DRDA security DHCP security TCP/IP port restrictions. License usage security To access these features, select 42. Advanced Security Features from the main menu and choose one of the options from the Advanced Security Features menu. Advanced Security Features 9