SAN LUNs in SMS
I previously discussed how important it is to verify LUN IDs before writing over them in AIX. What about before AIX is booted in SMS? How can you verify your LUNs in SMS?
Properly identifying SAN LUNs
I frequently work in large SAN environments, and I always want to verify the identity of any SAN disks (LUNs) which I receive before I write data to them. The rule is trust but verify, as it is disastrous to accidentally overwrite critical data in a shared storage environment.
Generating Passwords
I've recently been using hash generated passwords with customers as a more secure alternative to weak "default" passwords.
Using a Yubikey for AIX SSH login
Yubikeys offer a highly secure method for managing your SSH key for logging into AIX. SSH keys are much stronger than passwords, but like passwords they must be protected. A Yubikey provides a superior method to securely store SSH private key material in a physical token and can mitigate common attacks on SSH agents.
Using SSH instead of su and sudo
There are several ways to become root or another user in AIX. The
most common is via su, and the second is via the open source
sudo program. I recommend a third method, SSH to localhost.
AIX SFTP Best Practices
SFTP is a functional part of SSH which replaces the behavior of FTP in a secure fashion. This is great on AIX for transferring files, batch job uploads and downloads, and much more secure using SSL on the wire and with a variety of authentication options.
Unfortunately when left in the default configuration, the SSH server on AIX allows all users to use SFTP to access any files on the system (subject to filesystem permissions). It's common to see my customers be surprised when an unprivileged application account can SFTP in with WINSCP and browse their entire systems.
AIX SSH Best Practices
In recent years insecure and unencrypted protocols have been deprecated because they pose an unacceptable security risk on any network.
For daily usage systems administrators should use SSH to connect to AIX. SSH is encrypted on the wire and supports additional options for using secure keys instead of simple passwords. It completely replaces telnet and ftp, and all of the rsh tools.
IBM ships and supports their own OpenSSH compiled for AIX. I intend to review settings which should be configured in order to be secure.
AIX User Security Best Practices
Did you know that the original AIX crypt implementation [1] only allows 8 character passwords? That's really unacceptable by today's standards. AIX now supports several modern hashing algorithms for password storage and default crypt should no longer be used.
I recommend using SHA512, which is the strongest currently supported. With SHA512 password hashing, passwords up to 255 characters long are supported. That means your important root password should now be 32 characters long or more!
Tips and Tricks Presentation (2009)
In 2009 I gave a presentation at the Houston AIX Users Group on AIX tips and tricks. Much of this information is still useful, so this is just a repost of that presentation (PDF).
VIOS v3.1 upgrades failing from 2.2.6.51
Recently one of my customers had difficulty upgrading to PowerVM v3.1 using the alt_disk method. IBM's instructions are to upgrade your v2 VIO to the latest to ensure a smooth transition to v3, and then the alt_disk upgrade method was added in late 2.2.6.30.
Unfortunately in this case, there's a poorly documented bug in the installer. I decided to document it here to help others who may encounter it in the future.