Security

You can use Kerberos and single sign on with the Application Package on Linux® and Transport Layer Security (TLS) with the Application Package on Linux, macOS, and PASE.

Kerberos

The Linux Application Package supports IBM i authentication using Kerberos. To install and configure the IBM i platform for Kerberos, see the Single signon topic, in the Security topic collection in the IBM i Information Center.

Note: Most Linux distributions include at least one version of Kerberos 5, either Heimdal or MIT. However, some distributions do not create a symbolic link for the Kerberos shared library for Heimdal (/usr/lib/libgssapi.so) or MIT (/usr/lib/libgssapi_krb5.so). The Linux Application Package dynamically loads the Kerberos shared library, using the associated .so name. If a symbolic link is not available, you get the following error:

CWBSY1015
- Kerberos not available on this version of the operating system.

To use Kerberos with the Linux Application Package, you must first authenticate to your Kerberos domain using the kinit command or by setting up your initial Linux login to authenticate with the pluggable authentication module (PAM) Kerberos plugin. After successful authentication, you should be able to do a klist -f to see the status of your Kerberos tickets.

For any IBM i Access function, you can use *kerberos in place of the IBM i user profile to use your Kerberos tickets. Any password is ignored in this case.

The Kerberos principle name is based upon the fully qualified TCP/IP name received from the reverse lookup of the TCP/IP address. If you use a host file to resolve TCP/IP addresses, be sure to include the fully qualified TCP/IP system name. For example: 1.2.3.4 mysystem.example.com mysystem.

Transport Layer Security (TLS)

Start of change The Application Package supports TLS by way of the OpenSSL package provided by the operating system or on macOS via Homebrew. Unlike similar support on the Windows Application Package, which has its own certificate store, when using OpenSSL the package relies on the system certificate store. Refer to your system’s documentation on how to add CA certificates to your system’s certificate store. The SSL_CERT_FILE environment variable can also be used to set the path to a PEM certificate to use instead of the system's certificate store. End of change