Security for i Access Client Solutions

We need an option to setup the minimum Version of iAccess client Solutions (iACS) which is allowed to connect to a system i LPAR.

Additional we need to be able to restrict some functions / modules of iACS to be executed on a system i LPAR for default users and *ALLOBJ users.

In the earlier versions of iAccess Client Solutions (iACS) there was a security problem.

As iACS uses object based authority settings, but some even older applications running on the i using application based authority and additional security optiones to be setup as e.g. function usage.

Some of these security issues are fixed in later versions of iACS (e.g. allow/deny host prointing by using function usages since iACS 1.1.6.0)

Some new features of iACS are dangerous (e.g. the integrated file system module)

In the integrated file system module a user without special athorities can change from his home directory to / (root) or to /qsys.lib/abc.lib and delete objects within this path. As mentioned the objects can't get a more restricted athorisation because our applictaion uses internal functions to allow the users to get access to the objects and it needs the object autorities as they are. Even if changing the autority would be possible within the libraries of our application we woudn't be able to set the *PUBLIC athority of / or /qsys.lib to *EXCLUDE. If we do so the OS is getting in trouble.

Customers are able to deploy a version of iACS where modules which aren't /shouldn't be used by the employees are removed. But this doesn't protect the data on the system.

Even if we deploy a version of iACS with less modules. Someone who wants to get access to our data only needs the full version of iACS. With this full version he will be able to use the modules we removed from the version of iACS we've deployed.

So deploying a restricted Version is some kind of client based security but we need host based security as we used to have with client access for windows before.

Even if new security features are implemented in newer versions of iACS. The old versions will get access to the data without using this security enhancements. Therefore we need a possibility to deny the access to the system with iACS Versions older than a specific one we want to use on our systems.

We also need the possibility to restrict the usage of the modules like
-data transfer
-5250 emulator
-integrated file system
-navigator on i
-printer output

-run SQL scripts
-SQL performance manager
…
for default users and *ALLOBJ user level on host level.