RE: Locking an ip interface to user profiles

["Chris Bipes" <chris.bipes@xxxxxxxxxxxxxxx>]

Yes and No.  You will have to use exit programs to restrict who can
attach to the server from a remote system at that particular IP address.
The exit program should give you the local IP and Port as well as the
remote IP, Port, and User.  From that you can give a thumbs up or down.

As for who can bind to the IP address for outbound connections, you can
set port restrictions to certain user profiles.

 

Chris Bipes
Director of Information Services
CrossCheck, Inc.


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Kirk Goins
Sent: Thursday, August 20, 2009 8:27 AM
To: Midrange Systems Technical Discussion
Subject: Re: Locking an ip interface to user profiles

I would think an Exit Program should do the trick. I don't do them, but
I've
seen lots of places use them. In fact I know that is how a number of the
TCP/IP security products do there jobs.





On Wed, Aug 19, 2009 at 1:15 PM, Lance Gillespie
<lgillespie@xxxxxxxx>wrote:

> Is it possible to secure a tcp/ip interface so that it can only be
used
> by enumerated user profiles?
>
> That is, I use Add TCP/IP Interface (ADDTCPIFC) to add a new IP
address
> to the iSeries and then do something so that only certain profiles can
> use the new interface?
>
> I have the ports locked down, but would like to add profile security.
>
> I suspect the answer is no since I could not find anything about it
and
> it looks like security is further up the ISO stack, but I thought I
would
> ask.