IBM AS/400 (also known as IBM iSeries) is approaching its 30th birthday. The system released in 1988 is still alive today and widely used across industries all over the world. Do you use AS/400 at your company? Have you been thinking of scaling up the security? Do you want to use SSL protocol to secure connection to AS/400 system and its DB2 database? Establish Secure Connection to IBM AS/400 in few steps with the help of CloverDX. All the necessary steps are described in the article below.
The instructions below are for the most common CloverDX Server setup – UN*X operating system and application container Tomcat.
The configuration can’t be done without an existing SSL certificate installed on the AS/400 server side. This is the only piece of work required on the server side. All the rest is done on the client side.
JDBC driver must be used by CloverDX Server to access the remote DB2 database. There are two JDBC drivers available – native IBM Toolbox for Java and an alternate open source version called JTOpen. Both tools are maintained by the same development team, however the open source version is updated more frequently. We tested the solution on the open source version.
Database connections in CloverDX There are two ways to connect with a database in CloverDX. Using a JDBC driver together with generic database components ( DBInputTable, DBOutputTable, DBExecute), or using one of our bulk writers component ( DB2DataWriter). For our task using JDBC driver would be the correct method.
All configuration steps described below are done on AS/400 client running instance of CloverDX Server.
1. Import your AS/400 SSL certificate into your truststore
First we need to import DB2 server's certificate into our truststore file, then configure CloverDX Server to use this truststore. We will use the Keytool utility to do this job. Command will look like this.
It will create a new truststore called CloverTrustStore in $CATALINA_HOME/security folder and import the certificate from cert.arm file into a new key called as400_clovercert.
The system will asks two times for a new TrustStore password. Choose one according to your preference. Once the password is set, the system asks you if the imported certificate can be trusted. Type “yes” and press <Return>.
CATALINA_HOME is a system variable and its value can be found on “Environment properties” under Configuration > System Info section of CloverDX Server.
Note: You don't have to create a separate truststore for the CloverDX application. You can import the key into a default truststore located under JAVA_HOME/jre/lib/security/cacerts. In this case, the imported certificate would be available for all applications using the specified Java installation.
2. Grant access to your new truststore
Now you need to grant "read" access to the truststore for the users running CloverDX Server instance so they are able to utilize the certificate while using the JDBC connection.
3. Set path to your new truststore
Note: This step is not required if certificate had been imported into the default truststore.
In this step we will tell CloverDX where our new truststore is located. To do this, we need to amend the configuration file which passes JAVA_OPTS parameters to our CloverDX Server during the startup. If we have installed the CloverDX all-in-one bundle, the file is called setenv.sh (or setenv.bat) and is located under CATALINA_HOME/bin/ directory. If we are running a custom installation, the file is located under the application container configuration directory and the file name may be different.
Once we have located the file, following text should be added at the end of JAVA_OPTS definition.
# CloverDX connections certificate truststore
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=<path to our new truststore>"
If you want to check an integrity of your TrustStore before the connection is established, provide also your TrustStore password. However this step is not necessary.
Almost there. The last step is the database connection definition. All we need to do is to set the parameter secure=true to encrypt all communication between server and client. Beside the encryption of connection, the SSL certificate will be used to authenticate the server.
When you use a JNDI connection type, navigate to your JNDI definitions and modify your AS/400 database connection as follows.
If you are using standard JDBC connection, your definition might look like this:
As a security precaution, you may want to prevent the ETL developers from knowing the database passwords required for the JDBC configuration. We keep this in mind during CloverDX development and offer the user options to secure their database passwords. You can protect your passwords using a CloverDX Secure Parameters.
We managed to secure our AS/400 database connection in four easy steps which took no more than 30 minutes to complete. There are lots of rumours about the AS/400 platform circling within the IT community regarding the difficulties of integrating tools from different eras of computing. However, you can be at ease for this configuration is smooth and easy. As security continues to play a big role in data processing, it’s good to know that CloverDX can help you to cope with security challenges in such a convenient manner.
Data integration software and ETL tools provided by the CloverDX platform (formerly known as CloverETL) offer solutions for data management tasks such as data integration, data migration, or data quality. CloverDX is a vital part of enterprise solutions such as data warehousing, business intelligence (BI) or master data management (MDM). CloverDX Designer (formerly known as CloverETL Designer) is a visual data transformation designer that helps define data flows and transformations in a quick, visual, and intuitive way. CloverDX Server formerly known as CloverETL Server) is an enterprise ETL and data integration runtime environment. It offers a set of enterprise features such as automation, monitoring, user management, real-time ETL, data API services, clustering, or cloud data integration.