First look at security in 7.6 TR2 and 7.5 TR8

IBM announced the next round of TRs for 7.5 and 7.6, Here's a first look at updates related to IBM i security.

Here are the detailed announcements from IBM i for these TRs:

• IBM i 7.5 TR 8
• IBM i 7.6 TR 2

SYSTOOLS.CVE_INFO() SQL function

The update we are most interested in the new SQL function SYSTOOLS.CVE_INFO(). This function is the result of an IBM Idea submitted by our team (and others) and was developed with input from our team. It closes a critical platform compliance gap by providing information, from IBM, about published CVEs for IBM i. This function will search the CVE database and list the IBM i CVEs for the release you’ve specified, providing critical compliance visibility.

Other new SQL functions

There are two new functions for querying QAUDJRN transactions: SYSTOOLS.AUDIT_JOURNAL_JD() and SYSTOOLS.AUDIT_JOURNAL_RU(). JD records are for Job Description changes. RU records are captured when user profile authorities are restored.

A complete list of audit journal record types can be found here.

SYSTOOLS.GROUP_PTF_CURRENCY_LOCAL() provides a means to check PTF currency against a local file instead of using the "phone home" feature in SYSTOOLS.GROUP_PTF_CURRENCY(). This is useful for systems that do not have internet access. Admins can download a PTF file from IBM, save to a local file location and use it to evaluate PTF currency of the system. The Kisco team also worked with IBM on this new function.

Navigator for i

We can expect greatly improved security configuration visibility with these new TRs.

• New CVE Information table to display CVE counts for each system
• In Network, we will see all ports configured for server, along with TLS setting, all IAS/IWS/HTTP servers TLS Wizard
• TLS/Certificate visibility
  • Network TLS Wizard - support for TCP/IP servers
  • TLS Configuration - Added LDAP support
  • Add ADMIN servers to Network TLS configuration

ACS Run SQL scripts

Scott Forstie and his team have been hard at work adding new "Insert from Examples" SQL scripts for more and more security visibility. Some of the new sample scripts include:

• Security - How many libraries are OPEN for attack?
• Security - How many libraries are OPEN for attack? (ownership perspective)
• Security - Which commands can anyone use?
• Security - Which libraries contain commands that anyone use?
• Security - What Database triggers exist?
• Security - What are the IFS home directories, where the owner doesn't match the home dir?
• Security - IFS directories with a name and owner mismatch not using *PUBLIC *EXCLUDE
• Security - IFS home directory contents object ownership mismatch (detail report)
• Security - IFS home directory contents object ownership mismatch (summary report)
• Security - Data areas where any user can see the value (detail report)
• Security - Data areas where any user can see the value (summary report)
• Security - Data areas where anyone can change data area value (detail report)

Complete information about the latest ACS update can be found here.

Security enhancements

Other OS-level security updates include:

• Key management updates for Cryptographic services
• SMTP now supports OAuth credentials
• VS Code – Code for i now supports authentication via an SSH key passphrase

QIBM_IOSYSCFG_DDM function usage (7.6 only)

This Function Usage update grants DDM management rights instead of requiring user to have *IOSYSCFG special authority. This part of an ongoing effort from IBM to help us limit special authorities for end users.

As with any OS update from IBM, these new features and updates are only effective when customers choose to implement or use them. We encourage everyone to review their ongoing security practices to adapt to the updated tooling provided by IBM. Contact Kisco for help with a security assessment or input and advice into your security strategy.