AS/400

As400 midrange
founder:	ruza
depends on:
interested:	maxfx malanius sachy RAINBOF\	status=radioaktivni
software license:	-
hardware license:	-

~~META: status = active ~~

The IBM System i, then known as the AS/400, was the continuation of the System/38 database machine architecture (announced by IBM in October 1978 and delivered in August 1979). The AS/400 removed capability-based addressing.The AS/400 added source compatibility with the System/36 is combining the two primary computers manufactured by the IBM Rochester plant. The System/36 was IBM's most successful mini-computer but the architecture had reached its limit. The first AS/400 systems (known by the development code names Silverlake and Olympic) were delivered in 1988 under the tagline “Best of Both Worlds” and the product line has been refreshed continually since then.

IBM AS/400 is actually not a mainframe from a hardware point of view, precisely said its an midrange server, but philosophy of operating system is very close and available for “getting to know” about mainframe technologies. We have one such machine in our hackerspace and there are people who are interested in gaining skills with this technology.

What is commonly named as as400 had a few generations throughout the history:

• Generation 1 - AS400 (running OS400 operating system)
• Generation 2 - eServer iSeries (running i5/OS operating system)
• Generation 3 - System i (running i5/OS operating system)
• Generation 4 - Power Systems (optionally running the IBM i Operating system)

<figure>

</figure> <figure>

</figure> <figure>

</figure>

• Power Supply Magnetek 3902-55-1 foto
• backside foto
  • S1 - (has a square-wave-form symbol). To be able to connect via this port AS400 needs to be in Standby Operation mode (02 M). Then You can connect using serial cable from your Operations Console computer and open the ASMI in serial mode.
  • J11 (remote power on); J14 (UPS); J15 (SPCN 0); J16 (SPCN 1).
  • C07 - empty
  • C06 - 2838, Ethernet card
  • C05 - 2746, Twinax console card
  • C04 - 2842, IBM 2842-9406 PCI Node IOP Card, 53P3459
  • no label, empty
  • C03 - 2749, IBM 04N5036 SCSi Magnetic PCI Media Controller
  • C02 - empty
  • C01 - 2763, RAID SCSI controller

• more foto of the hardware
• System case features (ibm.com)

Frontend panel (or Control Panel) has four important buttons:

• Up/Down (aka increase/descrease) - two black buttons (F)
• Enter - blue button (G)
• Power - white button (B)

• (A) Power On Light
  • A blinking light indicates power to the unit.
  • A constant light indicates that the unit is up and is working.
• (B) Power button
• (C) Processor Activity
• (D) System Attention
• (E) Function/Data Display
• (F) Increment and Decrement buttons
• (G) Enter button

In order to select to which console output will be sent hold “space bar” key and PowerOn.

There are following console types.

• Operations Console
  • direct-attached or direct cable attachment - 9-pin serial
  • LAN attached or LAN console
• Hardware Managed Console (HMC)
• Thin Console - Neoware c50 thin client running a customized Linux image, which includes an IBM 5250 emulator. It boots from internal flash memory.
• Twinax - A 5250 device, or equipment which emulates one. Must be wired to the first twinax controller IOP on port 0 (zero) and setup with logical address 0 (zero)

In order to BOOT UP into normal operation mode perform following steps on the frontend control panel:

1. select function 02 using black buttons and Enter by pressing the blue button
2. select IPL type B using black buttons and Enter by pressing the blue button
3. select IPL mode N using black buttons and Enter by pressing the blue button
4. power on using white button

Various alphanumeric codes will be shown on the display panel. That means the system is booting fine. Wait few minutes. If it will be stuck at some alphanumeric code for more than few minutes, just google that code and you will know what is broken.

In order to properly POWER OFF an AS400 issue an PWRDWNSYS command from OS or perform following steps on the frontend control panel:

1. select function 02 using black buttons and Enter by pressing the blue button
2. select IPL type B using black buttons and Enter by pressing the blue button
3. select IPL mode M using black buttons and Enter by pressing the blue button
4. press the white button. A system should respond showing an 0? code on the display
5. power off using white button again
6. wait few minutes till AS400 properly shuts itself down
7. shutdown terminal (power button on terminal)

or

1. select function 08 using arrow keys on the front panel of server and confirm question 0? by pressing twice white button.
2. wait few minutes to shutdown
3. shutdown terminal (power button on terminal)

boot into 02 C M S

is similar to single user mode from UNIX world (all the subsystems have ended and only a single user job remains active). (RestrictedState.pdf (ibm.com))

control panel functions (ibm.com)

IPL type: A, B, C, D (You will probably almost always use the “B” side.)

• A - original LIC with permanently applied PTFs (no temporary PTF)
  • When IPL type B fails
  • When the procedures direct you to use IPL type A
  • When you suspect problems with temporary Licensed Internal Code PTFs
• B - production version of the LIC with temporary PTF applied
  • - loads a copy of the Licensed Internal Code that has both the Temporary and Permanently applied PTFs. This is normally your most current or newest code. You would use the B side most of the time, especially for routine work. You would run from this side when you permanently apply certain PTFs.
• C - reserved for hardware service representative use.
• D - installing and reloading programs. This loads the system programs from an alternate IPL load source, such as a tape drive or CD-ROM. You would also use this if your load source disk had failed, or installing a new system. You can both “scratch” install a system (initialize it) at this point, or just replace the license internal code. For booting from CD you need disc labelled “1BASE LIC MACH. CODE”. For installation “B2995 01” and then “B2995 02” - you'll be requested to change the CD on the appropriate time.

• Normal (unattended) - When you power on the system in normal mode, it performs the IPL and presents the Sign On screen on all available display stations. The operator cannot change the system during the IPL. You would use a normal mode IPL to:
  • Perform an IPL and run the system for most routine work
  • Load PTFs
• Manual (attended) - After power-on an operator uses the control panel to direct the system for special needs. IPL, DST and the operating system present menus and prompts that allow you to make changes to the system. Use manual mode to IPL and run the system to perform the following actions:
  • Change IPL options (including system values)
  • Install the operating system
  • Manually load program temporary fixes (PTFs)
  • Make some types of system hardware upgrades
  • Use DST
  • For some Disk maintenance & management.

IPL speed is changeable while the system is powered off.

• Start and stop iSeries (ibm.com)
• Control panel buttons, lights, and indicators (ibm.com)
• AS400 service functions (ibm.com)
• CHGIPLA: Secrets Of The IBM i IPL Parameters (itjungle.com)
• Secrets of IPLs exposed

• function 21 + Enter, QSECOFR password

• https://publib.boulder.ibm.com/iseries/v5r2/ic2924/index.htm?info/rzamh/rzamhaccess.htm
• Recover or reset QSECOFR passwords (QSECOFR user profile vs service tools user ID)

If there is an error code a6005008 on display, a console is either off, in wrong port (for Twinax must be port 0, address 0 to be the system primary console) or misconfigured. There is a good howto on midrange.com ML about configuring the console from the front panel. (If you go from 65+21 to 11 to see your changes wait a little bit, it takes ~5-10s to apply and display correct values). System *probably* must be in the manual IPL mode.

You can view and change settings of the Twinax console itself using Shift-SetUp keys - remember it should be configured to be port0, address 0 and one display only.

iSeries Operations Console Intermediate Configuration

Telnet 5250, or TN5250 describes either the process of sending and receiving 5250 data streams using the Telnet protocol or the software that emulates a 5250 class terminal communication via that process. TN5250 allows a 5250 terminal emulator to communicate over a TCP/IP network instead of an SNA network. Standard telnet clients cannot be used as a substitute for TN5250 clients, as they use a different data stream format.

"green console" on your pc/ntb

• SSL2 patch for Ubuntu client

--- sslstream.c 2008-11-21 09:12:21.000000000 +0100
+++ sslstream-new.c     2014-10-18 04:56:12.000000000 +0200
@@ -368,16 +368,13 @@
         methstr[4] = '\0';
    }
 
-   if (!strcmp(methstr, "ssl2")) {
-        meth = SSLv2_client_method();
-        TN5250_LOG(("SSL Method = SSLv2_client_method()\n"));
-   } else if (!strcmp(methstr, "ssl3")) {
-        meth = SSLv3_client_method();
-        TN5250_LOG(("SSL Method = SSLv3_client_method()\n"));
-   } else {
-        meth = SSLv23_client_method();
-        TN5250_LOG(("SSL Method = SSLv23_client_method()\n"));
-   }
+   if (!strcmp(methstr, "ssl3")) {
+         meth = SSLv3_client_method();
+         TN5250_LOG(("SSL Method = SSLv3_client_method()\n"));
+    } else {
+         meth = SSLv23_client_method();
+         TN5250_LOG(("SSL Method = SSLv23_client_method()\n"));
+    }
 
 /*  create a new SSL context */

is an Java alternative client (http://tn5250j.sf.net)

• Instalation must be performed in mode 01 A M V=F.
• OS/400 instalace OS
• OS/400 commands

• OS/400 IPL status SRC R5v4
• IPL system reference code finder

• http://www.blackhat.com/presentations/bh-europe-06/bh-eu-06-Carmel/bh-eu-06-Carmel.pdf
• OS/400 security settings, Tips and Tools for Securing Your iSeries
• DEF CON 23 - Bart Kulach - Hack the Legacy: IBM I aka AS400 Revealed (youtube.com), pdf
• Reverse shell using netcat on AS/400

How to reset ASMI passwords on a IBM POWER5 server (9131 model)

• https://wiki.midrange.com/index.php/History_of_OS/400History of OS/400
• Základy AS/400. Vladimír Župka
• CL commands: project:mainframe:commands
• texas400: tutorial, tips, etc
• IFS Security Weaknesses You Must Secure Now
• Instalation
  • Media labels and their contents
  • Standart set products
  • License Key Requirements for V5R4M0
  • OpenSSH for i5/OS
  • http://as400training2all.blogspot.cz/2014/10/what-is-as400.html
  • API
  • Serial number
  • Pass DTS

• in case telnet/tn5250 is failing check number of virtual devices allowed

1. CRTUSRPRF USRPRF(BRMSEC) PASSWORD(MYSECRETPASSWORD) USRCLS(*SECOFR) SPCAUT(*USRCLS)
2. under SECTOOLS (menu 3 10 8) add user to active profile list
3. in case CPF1110 happened as a response to auth attempt read this
   after “CHGSYSVAL SYSVAL(QLMTSECOFR) VALUE('0')” QSECOFR is also able to log in via telnet

• doinstalovat
  • iSeries Access Family (5722-XW1)
  • QSHELL (5722ss1-0030)
  • ILE COBOL (?) 0 5722wds-0041
• daykill400, hack400tool

https://brmlab.cz/event/as400clcobol