4 Easy Steps to Establish Secure Connection to IBM AS/400 Database with CloverETL

Share this article:

IBM AS/400 familyIBM AS/400 (also known as IBM iSeries) is approaching its 30th birthday. The system released in 1988 is still alive today and widely used across industries all over the world. Do you use AS/400 at your company? Have you been thinking of scaling up the security? Do you want to use SSL protocol to secure connection to AS/400 system and its DB2 database? Establish Secure Connection to IBM AS/400 in few steps with the help of CloverETL. All the necessary steps are described in the article below.

Prerequisites

  1. The instructions below are for the most common CloverETL Server setup – UN*X operating system and application container Tomcat.
  2. The configuration can’t be done without an existing SSL certificate installed on the AS/400 server side. This is the only piece of work required on the server side. All the rest is done on the client side.
  3. JDBC driver must be used by CloverETL Server to access the remote DB2 database. There are two JDBC drivers available – native IBM Toolbox for Java and an alternate open source version called JTOpen. Both tools are maintained by the same development team, however the open source version is updated more frequently. We tested the solution on the open source version.
Database connections in CloverETL
There are two ways to connect with a database in CloverETL. Using a JDBC driver together with generic database components ( DBInputTable, DBOutputTable, DBExecute), or using one of our bulk writers component ( DB2DataWriter). For our task using JDBC driver would be the correct method.

Configuration steps

All configuration steps described below are done on AS/400 client running instance of CloverETL Server.

1. Import your AS/400 SSL certificate into your truststore

First we need to import DB2 server's certificate into our truststore file, then configure CloverETL Server to use this truststore. We will use the Keytool utility to do this job. Command will look like this.

keytool -import -file cert.arm -alias as400_clovercert -keystore CATALINA_HOME/security/CloverTrustStore

It will create a new truststore called CloverTrustStore in $CATALINA_HOME/security folder and import the certificate from cert.arm file into a new key called as400_clovercert.

The system will asks two times for a new TrustStore password. Choose one according to your preference. Once the password is set, the system asks you if the imported certificate can be trusted. Type “yes” and press <Return>.

CATALINA_HOME is a system variable and its value can be found on “Environment properties” under Configuration > System Info section of CloverETL Server.

Note: You don't have to create a separate truststore for the CloverETL application. You can import the key into a default truststore located under JAVA_HOME/jre/lib/security/cacerts. In this case, the imported certificate would be available for all applications using the specified Java installation.

2. Grant access to your new truststore

Now you need to grant "read" access to the truststore for the users running CloverETL Server instance so they are able to utilize the certificate while using the JDBC connection.

3. Set path to your new truststore

Note: This step is not required if certificate had been imported into the default truststore.

In this step we will tell CloverETL where our new truststore is located. To do this, we need to amend the configuration file which passes JAVA_OPTS parameters to our CloverETL Server during the startup. If we have installed the CloverETL all-in-one bundle, the file is called setenv.sh (or setenv.bat) and is located under CATALINA_HOME/bin/ directory. If we are running a custom installation, the file is located under the application container configuration directory and the file name may be different.

Once we have located the file, following text should be added at the end of JAVA_OPTS definition.


# CloverETL connections certificate truststore
JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=<path to our new truststore>"

If you want to check an integrity of your TrustStore before the connection is established, provide also your TrustStore password. However this step is not necessary.


JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStorePassword=<your TrustStore password>"

4. Modify your database connection

Almost there. The last step is the database connection definition. All we need to do is to set the parameter secure=true to encrypt all communication between server and client. Beside the encryption of connection, the SSL certificate will be used to authenticate the server.

When you use a JNDI connection type, navigate to your JNDI definitions and modify your AS/400 database connection as follows.


<Resource
name="jdbc/<your connection name>"
auth="Container"
type="javax.sql.DataSource"
driverClassName="com.ibm.as400.access.AS400JDBCDriver"
url="jdbc:as400://<server URL>/<database name>;secure=true"
username="<username>"
password="<password>"
maxActive="100"
maxIdle="20
validationQuery="select 1 from sysibm.sysdummy1"
testWhileIdle="true"
timeBetweenEvictionRunsMillis="300000"
maxWait="10000"/>

If you are using standard JDBC connection, your definition might look like this:

Secure connection to IB? AS/400.

As a security precaution, you may want to prevent the ETL developers from knowing the database passwords required for the JDBC configuration. We keep this in mind during CloverETL development and offer the user options to secure their database passwords. You can protect your passwords using a CloverETL Secure Parameters.

Conclusion

We managed to secure our AS/400 database connection in four easy steps which took no more than 30 minutes to complete. There are lots of rumours about the AS/400 platform circling within the IT community regarding the difficulties of integrating tools from different eras of computing. However, you can be at ease for this configuration is smooth and easy. As security continues to play a big role in data processing, it’s good to know that CloverETL can help you to cope with security challenges in such a convenient manner.

Share this article:
Contact Us

Further questions? Contact us.

Forum

Talk to peers on our forum.

Want to keep in touch?

Follow our social media.

Topics

see all