To create a new file share use Navigator for i. There may be more, depending on the features installed. This means that anyone with access to root can create a directory and store inappropriate material on the system-this is called “parking.” It also means that anyone on the system can update or delete inappropriately secured file system objects-hardly the control a security administrator needs to ensure a stable and available system and accurate production data.įile shares are what makes a file system or a directory within the file system available for viewing or manipulation via the network. So the wide-open definition of ‘/’ is continually propagated. The same is true when stream files, text files, or other objects are created into a directory. When a directory is created it usually inherits the authority of its parent directory. The wide-open access of root is compounded whenever a directory is created into root. In IBM i terms this would be the same as the QSYS library having *PUBLIC authority *ALL. In other words, everyone on the system has the authority to perform any action against root. Root is shipped with public having all access. The security issue with root is how its default or public (*PUBLIC) access is defined. The root directory is where many IBM i products (including iAccess and WebSphere) and TCP/IP applications, as well as thirdparty applications, store code, data, and configuration files. One of the most challenging issues for IBM i security administrators today is managing the security associated with the various file systems-in particular, the security (or lack of security) associated with root (‘/’). Other file systems may be available, depending on the features and products installed on the system.
(See Figure 1.) Those file systems include the QSYS.LIB file system (which is the “traditional” IBM i file system that we are all familiar with), the NFS file system, the QNTC file system that supports the Integrated xSeries Server and other Windows 2000 servers on the network.
First, let me clarify what I mean by the term “IFS.” Integrated File System or IFS is really the name given to a set of file systems that are available in IBM i.
0 kommentar(er)
