Re: Penetration testing IBMi 7.3?

[Raul Alberto Jager Weiler <raul.jager@xxxxxxxxx>]

The weak access path to your IBMi can be via the corporate VPN.

On Tue, Jul 21, 2020 at 1:01 AM Laurence Chiu <lchiu7@xxxxxxxxx> wrote:

> We arevmoving a production system from one data centre to another. There
> will be prod in one, DR in the second. The application is pure RPG on IBMi
> with green screen access., There is no web application. The Power servers
> are behind application firewalls and the only external access to the
> servers is via the corporate VPN.
>
> There is discussion that we need to perform penetration testing but I
> cannot work out what that scope might be. We do have web based applications
> but they don't talk to IBMi at all. The closest we have are some web based
> applications that grab balances from a mainframe application using MQ
> messaging and then the CICS transaction might send a message to the IBMi
> application over MQ to get a balance from another system.
>
> I guess we could ask our pen testing organisation to start with the IP
> address of the application web server and then see if they can somehow get
> to the IBMi server console but that seems very tricky since the IBMi box
> isn't advertising any services and supports only 5250 access, MQ and
> Correct:Direct.
>
> Anybody in a similar position can provide some insight?  Thanks
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.
>
> Help support midrange.com by shopping at amazon.com with our affiliate
> link: https://amazon.midrange.com