IBM Power Ideas Portal
Hide about this portal


This portal is to open public enhancement requests against IBM Power Systems products, including IBM i. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas

  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.

Add a new idea Subscribe
Status Future consideration
Workspace IBM i
Categories System Management
Created by Guest
Created on Jun 9, 2021

RELATED IDEAS

Remove temporary files from data directory after creating AFP resource through AFP Manager in Navigator for i

See this idea on ideas.ibm.com

When creating an AFP resource using AFP Manager in Navigator for i, the temporary file used to create the resource on the IBM i is stored in the
/QIBM/UserData/OS400/Navigator/config/data directory. The temporary files are not cleared after the AFP resource is successfully created on the IBM i.
Since the temporary files are not cleaned up, some may experience an authority issue if attempting to upload a file with the same name as an existing file after applying the PTF for APAR SE68845.
In addition, this is a potential security risk. Page segments and overlays may include signatures or other personal information (PI) or sensitive personal information (SPI). Someone knowledgeable with the process of creating AFP resources on the IBM i can use the temporary file in the
/QIBM/UserData/OS400/Navigator/config/data directory to create a new resource and use it for other purposes.


Use Case:

- Overlay or page segment is created using Windows AFP print driver
- Overlay or page segment is imported through AFP Manager in Navigator for i
- After a period of time, the overlay or page segment is changed
- The updated object has the same name as the old object
- The import through AFP Manager in Navigator for i fails due to an authority failure
- The existing object in the /QIBM/UserData/OS400/Navigator/config/data directory has *PUBLIC *EXCLUDE as it was created before the PTF for APAR SE68845 was applied
- After clearing the directory or file, or renaming the file, the resource is successfully imported and created on the IBM i

Security exposure:
- Dr. Evil knows the newly created overlay or page segment includes a signature
- Dr. Evil doesn't have authority to the final AFP resource on the IBM i, but does have authority to /QIBM/UserData/OS400/Navigator/config/data directory
- Dr. Evil follows well known, published instructions for creating a new AFP resource using the temporary file
- Dr. Evil now has a second copy of the AFP resource and authority to use it


Idea priority Low
  • Guest
    Reply
    |     Nov 29, 2021

    IBM understands this requirement and will consider this in a future delivery

  • Guest
    Reply
    |     Jul 12, 2021

    The CEAC has reviewed this requirement and recommends that IBM view this as a MEDIUM priority requirement that should be addressed.

    Background: The COMMON Europe Advisory Council (CEAC) members have a broad range of experience in working with small and medium-sized IBM i customers. CEAC has a crucial role in working with IBM i development to help assess the value and impact of individual RFEs on the broader IBM i community and has therefore reviewed your RFE.

    To find out how CEAC help to shape the future of IBM i, see CEAC @ ibm.biz/BdYSYj and the article "The Five Hottest IBM i RFEs Of The Quarter" at ibm.biz/BdYSZT

    Therese Eaton – CEAC Program Manager, IBM

  • Guest
    Reply
    |     Jun 10, 2021

    Due to processing by IBM, this request was reassigned to have the following updated attributes:
    Brand - Servers and Systems Software
    Product family - Power Systems
    Product - IBM i
    Component - System Management
    Operating system - IBM i
    Source - Client

    For recording keeping, the previous attributes were:
    Brand - Servers and Systems Software
    Product family - Power Systems
    Product - IBM i
    Component - IBM i Access Family
    Operating system - IBM i
    Source - Client

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.