Monitoring IBM i user profiles

After initial configuration of a user profile on your system, are you watching for updates to ensure your security scheme is being maintained over the profile's life?

Passive Audit

For passive audit of user profiles, use the system security audit journal.

To report on the creation of and changes to user profiles, use the following IBM i audit journal helper function. The SQL lists the CP (creation / changes to user profiles) audit journal entries that have occurred in the last 7 days.

SELECT *
FROM TABLE (
   systools.audit_journal_cp(starting_timestamp => CURRENT TIMESTAMP - 7 DAYS)
)
ORDER BY entry_timestamp;

To review the list of profiles deleted, you need to review the DO (deletion of objects) audit journal entries. This example lists the profiles deleted in the last 7 days:

SELECT entry_timestamp,
   job_name,
   job_user,
   job_number,
   user_name AS deleter,
   object_name AS deleted_profile
   FROM TABLE (
      systools.audit_journal_do(STARTING_TIMESTAMP => CURRENT DATE - 7 DAYS, ending_timestamp => CURRENT DATE)
   )
WHERE object_type = '*USRPRF'
ORDER BY entry_timestamp;

Our iEventMonitor software supports passive user profile monitoring with built-in alerts for user profile change (CP) audit journal records. iEventMonitor can also alert for most security related audit journal codes. Here's a notification for an invalid password attempt:

In this example, an alert has been sent for a password change:

User Profiles in IBM i SQL services

The USER_INFO and USER_INFO_BASIC table functions provide most of the detail you need to extract baseline reports. IBM documentation.

See this sample query in ACS Run SQL Scripts:

This query returns a list of users with expired passwords:

select *
from QSYS2.USER_INFO_BASIC
where DAYS_UNTIL_PASSWORD_EXPIRES = 0
order by coalesce(PREVIOUS_SIGNON, current timestamp - 100 years) asc;

Our iEventMonitor product automates IBM i monitoring which makes this type of reporting and alerting very easy. You can receive alerts for user profiles that are about to expire.

Real-time Monitoring

For critical or sensitive user profiles you may want more immediate, real-time notification of changes. You can use exit points for this. There are four key exit points to monitor:

• QIBM_QSY_CRT_PROFILE - Create User Profile
• QIBM_QSY_CHG_PROFILE - Change User Profile
• QIBM_QSY_DLT_PROFILE - Delete User Profile (2 points, one before the other after)
• QIBM_QSY_RST_PROFILE - Restore User Profile

Custom user profile exit programs

Our product, SafeNet/i gives customers the ability to integrate their own exit point programs for several user profile exits in the IBM i OS. See the following screenshot for the exits in question.