Posted on January 08, 2016
IBM AS/400 (also known as IBM iSeries) is approaching its 30th birthday. The system released in 1988 is still alive today and widely used across industries all over the world. Do you use AS/400 at your company? Have you been thinking of scaling up the security? Do you want to use SSL protocol to secure connection to AS/400 system and its DB2 database? Establish Secure Connection to IBM AS/400 in few steps with the help of CloverDX. All the necessary steps are described in the article below.
The AS400 database is the structured collection of records or data on IBM's AS400 server. It is a midrange server designed for small businesses and departments in large enterprises, and now redesigned so that it will work well in distributed networks with Web applications. Realizing the importance of compatibility with the thousands of programs written in legacy code, IBM launched the AS/400 midrange computer line in 1988.
All configuration steps described below are done on AS/400 client running instance of CloverDX Server.
First we need to import DB2 server's certificate into our truststore file, then configure CloverDX Server to use this truststore. We will use the Keytool utility to do this job. Command will look like this.
keytool -import -file cert.arm -alias as400_clovercert -keystore CATALINA_HOME/security/CloverTrustStore
It will create a new truststore called CloverTrustStore in $CATALINA_HOME/security folder and import the certificate from cert.arm file into a new key called as400_clovercert.
The system will asks two times for a new TrustStore password. Choose one according to your preference. Once the password is set, the system asks you if the imported certificate can be trusted. Type “yes” and press <Return>.
CATALINA_HOME is a system variable and its value can be found on “Environment properties” under Configuration > System Info section of CloverDX Server.
Now you need to grant "read" access to the truststore for the users running CloverDX Server instance so they are able to utilize the certificate while using the JDBC connection.
In this step we will tell CloverDX where our new truststore is located. To do this, we need to amend the configuration file which passes JAVA_OPTS parameters to our CloverDX Server during the startup. If we have installed the CloverDX all-in-one bundle, the file is called setenv.sh (or setenv.bat) and is located under CATALINA_HOME/bin/ directory. If we are running a custom installation, the file is located under the application container configuration directory and the file name may be different.
Once we have located the file, following text should be added at the end of JAVA_OPTS definition.
# CloverDX connections certificate truststore
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=<path to our new truststore>"
If you want to check an integrity of your TrustStore before the connection is established, provide also your TrustStore password. However this step is not necessary.
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStorePassword=<your TrustStore password>"
Almost there. The last step is the database connection definition. All we need to do is to set the parameter secure=true to encrypt all communication between server and client. Beside the encryption of connection, the SSL certificate will be used to authenticate the server.
When you use a JNDI connection type, navigate to your JNDI definitions and modify your AS/400 database connection as follows.
name="jdbc/<your connection name>"
url="jdbc:as400://<server URL>/<database name>;secure=true"
validationQuery="select 1 from sysibm.sysdummy1"
If you are using standard JDBC connection, your definition might look like this:
We managed to secure our AS/400 database connection in four easy steps which took no more than 30 minutes to complete. There are lots of rumours about the AS/400 platform circling within the IT community regarding the difficulties of integrating tools from different eras of computing. However, you can be at ease for this configuration is smooth and easy. As security continues to play a big role in data processing, it’s good to know that CloverDX can help you to cope with security challenges in such a convenient manner.