Security; Security - IBM eserver i5 Handbook

5486OpS.fm
systems and distributed systems that operate within a network controlled by a
host system or by another iSeries server.
Network management functions available for the iSeries server include:
Systems management in TCP/IP networks
Alerts support to NetView®, System/36, System/38, iSeries
Distributed System Node Executive (DSNX)

Security

The many levels of security available with i5/OS and OS/400 ease the job of
system security management. The five levels of security range from minimal to
an enhanced level that enables the iSeries servers to operate at the C2 level of
trust as defined by the United States Government. Security foundation offered
with i5/OS and OS/400 includes system integrity with digital signature and object
signing, a Digital Certificate Manager, and password protection.
The base level of security is set simply by using a system value, as shown in the
following table.

Security

Description
level
10 Minimal security
20 Password security
30 Resource security
40 Resource security and
operating system
integrity
50 Enhanced resource
security and operating
*
system integrity
* Enables iSeries servers to operate at the C2 level of trust as defined by the U.S. Government. Refer to publication
DOD 5200.28-STD, "Department of Defense Trusted Computer System Evaluation Criteria" (Orange Book), for
details about the U.S. Government definition of C2 trust level.
i5/OS and OS/400 is distributed with the security level set to 40.
IBM Eserver i5 and iSeries System Handbook
518
Draft Document for Review October 18, 2004
Use of this level
No passwords are used.
Passwords are used to provide
access to the system.
Passwords are required and object
usage can be controlled.
Passwords are required and object
usage can be controlled. Users can
be restricted to specific functions.
Passwords are required and object
usage can be controlled. Users can
be restricted to specific functions.
Using unsupported interfaces is
restricted.
Considerations
Any user can perform any function.
Any user can perform any function once
they are signed on.
Users can be restricted to specific
functions.
Using unsupported interfaces is
restricted.
Parameter validation into the operating
system and restrictions on use of user
domain objects. A security journal is
provided that logs all security violations.