disable the non SSL host server

As dcm, navigator, iws and http admin use the non SSL host services thru the loopback(localhost) interface, I believe a more viable solution would be if you configure the non SSL host server port to only bind to the localhost interface.

This option should be valid for most of the TCP servers, like the cimom server (only used be the ECS/ESA).

IBM i requires way to many ports to be open to function properly and security auditors always complains about this.

It seems that this request could be interpreted to be 2 things.
1. The ability to restrict all the ADMINx jobs to only use the secure ports when connecting to Host Servers. The referenced Case specifically calls out the fact that one of the jobs, believed to be ADMIN4, will only use the 8471 port which is the database server, job QZDASOINIT. The customer would like to force this job to use the secure port, 9471.
2. The ability to indicate that the host servers disable the non-secure ports, perhaps outside the currently supported option of adding a port restriction. This would be some configuration option specifically geared toward the host servers that support secure ports.

The development team will investigate these further.

IBM has received the requirement and is evaluating it.

There is an indirect process available for disabling the non-TLS ports described here: https://www.ibm.com/support/pages/how-disable-ip-tls-or-both-ports-ibm-i-host-servers

We are evaluating a more typical configuration setting to disable the non-TLS ports without the use of port restrictions. IBM will provide a response after evaluation is complete.

Hello,
I have been asked to open this ticket because despite of configuring http *ADMIN instance to SSL the *ADMIN will still used host servers 874* not 974*.
But if I can safely disable all 847* none ssl host servers we can close this reques.

Best regards,
Daniel

Due to processing by IBM, this request was reassigned to have the following updated attributes:
Brand - Servers and Systems Software
Product family - Power Systems
Product - IBM i
Component - Security
Operating system - IBM i
Source - None

For recording keeping, the previous attributes were:
Brand - Servers and Systems Software
Product family - Power Systems
Product - IBM i
Component - System Management
Operating system - IBM i
Source - None

The CEAC has reviewed this requirement and recommends that IBM view this as a HIGH priority requirement that is important to address.

There are many industry standards that require user not only to use encryption but prevent unencrypted in the first place. We would recommend IBM review and address this RFE.

Background: The COMMON Europe Advisory Council (CEAC) members have a broad range of experience in working with small and medium-sized IBM i customers. CEAC has a crucial role in working with IBM i development to help assess the value and impact of individual RFEs on the broader IBM i community and has therefore reviewed your RFE.

To find out how CEAC help to shape the future of IBM i, see CEAC @ ibm.biz/BdYSYj and the article "The Five Hottest IBM i RFEs Of The Quarter" at ibm.biz/BdYSZT

Therese Eaton – CEAC Program Manager, IBM

Due to processing by IBM, this request was reassigned to have the following updated attributes:
Brand - Servers and Systems Software
Product family - Power Systems
Product - IBM i
Component - System Management
Operating system - IBM i
Source - None

For recording keeping, the previous attributes were:
Brand - Servers and Systems Software
Product family - Power Systems
Product - IBM i
Component - Core OS
Operating system - IBM i
Source - None

In the mean while you can block access to these non-SSL servers via the build in firewall.