hi James,
In the HTTP *ADMIN instance, go to the "Digital Certificate Manager" (If
you're on 6.1 or higher, you'll need to click "IBM i Management /
Internet Configurations" to get to the DCM.)
Click "Select a Certificate Store", and then choose the *SYSTEM store.
You'll need to know the password for the *SYSTEM certificate store that
was assigned when it was created.
On the left navigation bar, again, click "Update application
definition", then "Server", then "IBM i TCP/IP Telnet Server". On the
following screen, make sure you have "Define the CA trust list" and
"Client authentication required" checked. Click "Apply"
On the left navigation bar on the screen, choose "manage applications",
then "define CA trust list", then "Server", then "IBM i TCP/IP Telnet
Server"
The next screen provides a list of all the SSL/TLS certificate
authorites installed on your system. If you only want to trust
certificates that you created, choose "LOCAL_CERTIFICATE_AUTHORITY" and
uncheck all the others. Click "OK" to activate.
You might also want to block non-SSL connections. To do that:
CHGTELNA ALWSSL(*ONLY)
I'm not certain whether you need to restart the telnet server for all
these changes to take effect? But, I assume so, so you'll want to do
(make sure you're not using a telnet connection to do this!)
ENDTCPSVR *TELNET
WRKACTJOB SBS(QSYSWRK)
Wait for the telnet server to end. To do that, look for any jobs whose
name starts with QTVxxxx these are telnet server jobs. hit F5 to
refresh until all of them are ended.
STRTCPSVR *TELNET
Now, the Telnet server should only accept connections from certificates
that were assigned by the LOCAL_CERTIFICATE_AUTHORITY CA certificate.
(You'll probably want to test this to verify that it all worked.)
Have fun.
On 3/16/2012 4:11 PM, James Rich wrote:
I'm fairly certain this is possible, but my reading so far hasn't turned
up an answer.
I want to permit uses to connect to our system using iSeries Access but
only if that user has a certificate that we have previously issued. We
want to issue certificates to users and only accept connections from
clients that have one of those certificates. Can this be done? If so,
how?
midrange.com
