Secure IBM i with cnspec

Use cnspec to assess the security configuration of IBM i systems running on IBM Power. cnspec exposes system values, user profiles and their special authorities, object authorities, PTF group currency, registered function usage, network attributes, NetServer shares, NFS exports, and the OpenSSH daemon configuration as MQL resources, so you can find risky settings and audit a system against the CIS IBM i Benchmark.

New to cnspec? Start with the Quickstart, or read the Operating systems overview to see every platform cnspec can secure.

PrerequisitesCopy Anchor Link

To scan an IBM i system with cnspec, you must have:

• cnspec installed on your workstation
• A user profile on the IBM i system that can sign on over SSH
• The SSH daemon running on the target (STRTCPSVR *SSHD)
• A command-line SQL runner on the target. cnspec uses iusql from unixODBC (/QOpenSys/pkgs/bin/iusql) by default, connecting through the *LOCAL data source that IBM i ships for the local database.

cnspec connects over SSH and runs read-only queries against the Db2 for i SQL services (the QSYS2 catalog views and table functions) and read-only CL commands. Nothing is installed on the target. The SQL runner runs under the connected user's own profile, so you don't need separate database credentials.

Connect to an IBM i systemCopy Anchor Link

Pass the host name or IP address of the system and the user profile to sign on as:

cnspec scan ibmi HOST --username auditor --ask-pass

To authenticate with an SSH key instead of a password:

cnspec scan ibmi HOST --username auditor -i ~/.ssh/id_ed25519

Scan with the CIS IBM i BenchmarkCopy Anchor Link

Mondoo Platform users can enable the CIS IBM i V7R5M0 Benchmark policy in their space. It covers system values, user profile and password controls, auditing, PTF currency, and network services at Level 1 and Level 2.

To scan with a policy file of your own, pass it with --policy-bundle:

cnspec scan ibmi HOST --username auditor --ask-pass --policy-bundle my-ibmi-policy.mql.yaml

When a scan completes, cnspec prints a summary of the checks it ran, grouped by policy. Each check shows a pass or fail result, and the report ends with a risk score from 0 (no risk) to 100 (highest risk). To send results to a file or change the output format, read Report Results.

Example checksCopy Anchor Link

Open a cnspec shell to explore the system interactively:

cnspec shell ibmi HOST --username auditor --ask-pass

Ensure the system security level is 40 or higherCopy Anchor Link

cnspec> ibmi.systemValue(name: "QSECURITY").numericValue >= 40
[ok] value: 40

Ensure no user profile has a default passwordCopy Anchor Link

cnspec> ibmi.userProfiles.all(defaultPassword == false)
[ok] value: true

List enabled profiles with special authoritiesCopy Anchor Link

cnspec> ibmi.userProfiles.where(status == "*ENABLED" && specialAuthorities.length > 0) { name userClass specialAuthorities }

Ensure remote sign-on requires a passwordCopy Anchor Link

cnspec> ibmi.systemValue(name: "QRMTSIGN").value == "*VERIFY"
[ok] value: "*VERIFY"

Ensure security PTF groups are currentCopy Anchor Link

cnspec> ibmi.ptfGroups.where(title == /Security|Hiper/).all(current == true)
[ok] value: true

Ensure NetServer file shares require encryptionCopy Anchor Link

cnspec> ibmi.serverShares.where(shareType == "FILE").all(encryptionRequired == true)
[ok] value: true

Learn moreCopy Anchor Link

• Mondoo IBM i Resource Pack Reference: every IBM i resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries
• Write custom policies: wrap your checks in a policy