SAN LUNs in SMS

I previously discussed how important it is to verify LUN IDs before writing over them in AIX. What about before AIX is booted in SMS? How can you verify your LUNs in SMS?

Read more…

Properly identifying SAN LUNs

I frequently work in large SAN environments, and I always want to verify the identity of any SAN disks (LUNs) which I receive before I write data to them. The rule is trust but verify, as it is disastrous to accidentally overwrite critical data in a shared storage environment.

Read more…

Using a Yubikey for AIX SSH login

Yubikeys offer a highly secure method for managing your SSH key for logging into AIX. SSH keys are much stronger than passwords, but like passwords they must be protected. A Yubikey provides a superior method to securely store SSH private key material in a physical token and can mitigate common attacks on SSH agents.

Read more…

AIX SFTP Best Practices

SFTP is a functional part of SSH which replaces the behavior of FTP in a secure fashion. This is great on AIX for transferring files, batch job uploads and downloads, and much more secure using SSL on the wire and with a variety of authentication options.

Unfortunately when left in the default configuration, the SSH server on AIX allows all users to use SFTP to access any files on the system (subject to filesystem permissions). It's common to see my customers be surprised when an unprivileged application account can SFTP in with WINSCP and browse their entire systems.

Read more…

AIX SSH Best Practices

In recent years insecure and unencrypted protocols have been deprecated because they pose an unacceptable security risk on any network.

For daily usage systems administrators should use SSH to connect to AIX. SSH is encrypted on the wire and supports additional options for using secure keys instead of simple passwords. It completely replaces telnet and ftp, and all of the rsh tools.

IBM ships and supports their own OpenSSH compiled for AIX. I intend to review settings which should be configured in order to be secure.

Read more…

AIX User Security Best Practices

Did you know that the original AIX crypt implementation [1] only allows 8 character passwords? That's really unacceptable by today's standards. AIX now supports several modern hashing algorithms for password storage and default crypt should no longer be used.

I recommend using SHA512, which is the strongest currently supported. With SHA512 password hashing, passwords up to 255 characters long are supported. That means your important root password should now be 32 characters long or more!

Read more…

VIOS v3.1 upgrades failing from 2.2.6.51

Recently one of my customers had difficulty upgrading to PowerVM v3.1 using the alt_disk method. IBM's instructions are to upgrade your v2 VIO to the latest to ensure a smooth transition to v3, and then the alt_disk upgrade method was added in late 2.2.6.30.

Unfortunately in this case, there's a poorly documented bug in the installer. I decided to document it here to help others who may encounter it in the future.

Read more…