Feature Article

Industry News for IBM i Security

Kisco Announces New Release of Password Reset for IBM i
Kisco Information Systems has announced Release 2 of iResetMe which is an end-user password reset utility that addresses the issue of re-activating disabled and expired profiles.
See the Press Release

Live Security Related Webcasts and Training for IBM i

August Events

Live Hands-On - IBM i System Administration and Control Workshop
with Dan Riehl
Training Workshop - Aug 18-22 - Presented by The 400 School, Inc.
Dan Riehl presents this 5-Day Live Online Hands-on Workshop.
More Information and Register to Attend

IBM i Encryption in a Snap!
Live Webcast - By IBM Systems Magazine - Sponsored by Enforcive
Thursday, August 21 1:00 pm CDT
More Information and Register to Attend

September Events

Live Hands-On - Expanded Security Workshop for IBM i, iSeries AS/400
with Dan Riehl
Training Workshop - Sep 8-11 - Presented by The 400 School, Inc.
Dan Riehl presents this 4-Day Live Online Hands-on Workshop.
More Information and Register to Attend

Live Hands-On - QAUDJRN Auditing and Forensic Analysis Workshop
with Dan Riehl
Training Workshop - Sep 25-26 - Presented by The 400 School, Inc.
Dan Riehl presents this 2-Day Live Online Hands-on Workshop.
More Information and Register to Attend

Security Shorts

When was your last SAVSYS, SAVCFG, SAVSECDTA ?

By Dan Riehl - SecureMyi.com

Backup and Recovery is an area that is critical to the security and integrity of our systems. If someone accidentally wipes out a file, or in the event of a large scale disaster, it's critical we have all of the pieces needed to recover the file, or the entire system.

We typically have a pretty good handle on when we last backed up our User Libraries, our Document Library objects, and the root '/' file system. But what about the last save of the operating system? And what about our user profiles and security data and our system configuration objects? When was that data last backed up? And what tape or other media contains the last backup?

When we save a library using the SAVLIB command, objects are marked with the save date and save device information, as long as we specify UPDHST(*YES). But when we save the operating system, the objects that are saved are not marked with the save information. The same is true when we save user profiles and configuration data. The saved objects are not updated with the last save date.

IBM has supplied some special purpose data areas in the QSYS library that are updated with the save date and save device information when we perform certain save operations.

When we save our security data (including user profiles) using the command Save Security Data (SAVSECDTA), the special data area QSAVUSRPRF in QSYS is updated to reflect the save date and time and save device information.

Below is a list of various SAVE commands and the associated QSYS data area. Upon execution of the command, the data area is updated.

Save Command          Data Area Updated 
SAVCFG		      QSAVCFG	
SAVLIB *ALLUSR	      QSAVALLUSR
SAVLIB *IBM	      QSAVIBM	
SAVLIB *NONSYS	      QSAVLIBALL
SAVSECDTA	      QSAVUSRPRF
SAVSTG		      QSAVSTG	
SAVSYS		      QSAVSYS, QSAVUSRPRF, QSAVCFG
SAVSYSINF 	      QSYSINF

Viewing the Last Save Date and Device

To view the last save information, you display the object description (DSPOBJD), you don't display the content of the data area. You can start with the command Work with Objects (WRKOBJ), as shown here:

WRKOBJ OBJ(QSYS/QSAV*) OBJTYPE(*DTAARA)

This command allows you to work with all the data areas in the QSYS library that start with the characters QSAV. This results in the following display:

      
                                Work with Objects                                
                                                                                
 Type options, press Enter.                                                     
   2=Edit authority        3=Copy   4=Delete   5=Display authority   7=Rename   
   8=Display description   13=Change description                                
                                                                                
 Opt  Object      Type      Library     Attribute   Text                        
  _   QSAVALLUSR  *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  _   QSAVCFG     *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  _   QSAVIBM     *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  _   QSAVLIBALL  *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  _   QSAVSTG     *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  _   QSAVSYS     *DTAARA   QSYS                    S/R DIRECTORY INFO FOR SAVE 
  8   QSAVUSRPRF  *DTAARA   QSYS                    S/R DIRECTORY INFO FOR REST 

Place option 8(DSPOBJD) next to one of the data areas. In the example, we chose QSAVUSRPRF to see when we last saved our security data (including user profiles). Scroll through the resulting list to see the last Save Date, and Save Volume.

If you simply want to examine one of the special SAVE data areas, you can use the command DSPOBJD. Here's an example that can be used to display the information on the last time we did a SAVSECDTA.

DSPOBJD OBJ(QSAVUSRPRF) OBJTYPE(*DTAARA)

While We're Here: Where IS Your SAVSYS?

While we're here discussing saving the system and its different pieces, check to make sure you're routinely saving your user profiles and system configuration data. Also check to make sure you have a good SAVSYS backup media handy. You probably did a SAVSYS operation the last time you made a major change to the operating system, like an OS upgrade, or after applying a cumulative PTF package.

If you don't have these backups available (SAVSYS, SAVSECDTA, SAVCFG), plan to do a the needed backups as soon as you can. You don't want to be stuck in a recovery scenario needing to go back to the original IBM distribution media. That would be a disaster on top of a disaster.