Category Archives: Web development

Computer Programming, Computing, IBMi, PHP, Web development

IBMi PHP

Zend Server basic will no longer be included with IBMi. IBM and Perforce have withdrawn Zend Server basic licenses for IBMi. Zend Server is still available as a licensed product from Perforce and should be considered for production systems. ZendPHP from Perforce can be installed as RPM from Perforce’s repository. Communityplus+ PHP can be installed as RPM from Seiden group. CommunityPlus+ PHP for IBM i – Seiden Group

Changes in the Licensing of Zend Server for IBM i

In a continuing effort to streamline our services and provide better value to our customers, Perforce Software and IBM are announcing changes to the licensing of Zend Server for IBM i:

  • Effective June 30, 2020, IBM will no longer be including Zend Server Basic entitlement with the IBM i operating system. At that time, clients using the one year of no-additional-charge Zend support will be entitled to complete that one year, ending on June 30, 2021.
  • Effective June 30, 2021, Perforce is withdrawing the Zend Server Basic license for IBM I, so that the license will be end of life. All Basic licenses will expire on June 30, 2021. However, you can still get Zend Server for the IBM i platform by purchasing licenses directly from Zend.

Zend Server Basic in IBM i EOL | Zend


COMMUNITYPLUS+ PHP

CommunityPlus+ PHP is a full-featured, high quality PHP distribution suitable for production use—built, maintained and supported by Seiden Group.

  • mail() functionality (via SMTP)
  • PHP Toolkit for IBM i (works with xmlservice/xml toolkit)
  • Zend Framework 1 (updated for PHP 7 and 8)
  • Composer, to make it easy to install new frameworks and components
  • Apache integration made easy with our siteadd utility

Extensions/modules

MODULEPURPOSE
bcmathAdvanced math
bz2Compression
calendarDate/time conversions
ctypeCharacter checks
curlNetwork protocols (communicate with web services and more)
dateDate handling
domXML parsing
exifImage metadata
fileinfoFile type guesser
filterData filtration
gdImage processing
gettextLocalization
gmpAdvanced math
hashHashing
ibm_db2Classic Db2 connectivity
iconvCodepage converter
imapIMAP mailboxes, mail address parsing
imagickImageMagick (image processing)
JSONJSON encoding/decoding
intli18n (internationalization) and Unicode. Required by Zend Framework (Laminas).
LDAPDirectory services (authenticate using Windows AD servers)
libxmlXML
mbstringComplex text (multi-byte)
mcryptEncryption (deprecated; openssl preferred)
mongodbMongoDB (NoSQL) connectivity
mysqli, mysqlndMySQL/MariaDB connectivity
oci8****Oracle connectivity
odbcOpen database connectivity (including new PASE driver)
opcachePerformance optimization
opensslCryptography and encrypted transport
pcntlProcess control
pcreRegular expressions
pdo_dblibMicrosoft SQL Server connectivity using FreeTDS
pdo_ibmClassic Db2 connectivity
pdo_mysqlMySQL/MariaDB connectivity
pdo_pgsqlPostgreSQL connectivity
PDO_ODBCOpen database connectivity using PDO
pharPHP archiver (run PHP code from a single file)
pgsqlPostgreSQL connectivity
posixUnix system functions
readlineCLI prompting
reflectionRuntime information
redisRedis support (key/value store; like memcache/apc)
shmopShared memory
SimpleXMLXML processing (used with XMLSERVICE and more)
ssh2SSH support
soapSOAP web APIs
socketsNetwork and domain socket connectivity
sodiumCryptography
SPLData structures and autoloading
sqlite3SQLite DB
sysvmsgSystem V messages
sysvmsgSysV semaphores
sysvmsgSysV shared memory
tidyHTML parsing and cleanup
tokenizerPHP parser
xdebugDebugging, profiling, tracing
xmlXML
xmlreaderXML
xmlwriterXML
xslXML
zipZIP archiver
zlibCompression

For more info and to download: CommunityPlus+ PHP for IBM i – Seiden Group

PHP on IBM i

PHP on IBM i

There are several ways to deploy PHP on IBM i, including:

  • Zend Server from Perforce
  • ZendPHP from Perforce
  • CommunityPlus+ PHP from Seiden Group

Side-by-Side Comparison of PHP Options

FeatureCommunityPlus+ PHPZend ServerZendPHP
Provider (and link to offering home page)Seiden GroupZend by PerforceZend by Perforce
Free to use?YesYes, until June 30, 2021Yes
Suitable for production workloads?Yes, with support in placeYes, with support in placeYes, with support in place
SupportAvailable from Seiden Group and/or IBM.Available through Zend Server paid licenseAvailable from Perforce or IBM.
Supported release lifespanDetermined by open source communityLong term support beyond community project timeframesDetermined by open source community
 Long-term support beyond community project timeframes is also available.
Classic ibm_db2 database connector supportSee this document for detailsSee this document for detailsSee this document for details
How to acquire and install?Install as RPM from Seiden GroupDownload from Perforce portal. Installed as IBM i Licensed Program (LPP) or an IBM i RPMInstall as RPM from Perforce’s repository
Available PHP extensionsfull list here. Others available upon request.Contact Perforcefull list here
IBM i toolkit included with distributionYesYesYes
Can integrate with IBM’s integrated Apache HTTP Server?Yes (can be automatically configured)YesYes (automatically done by installer)
Can integrate with the Nginx HTTP ServerYes (requires manual setup)Yes (requires manual setup)Yes (requires manual setup)
Database connectivityPDO_ODBC or odbc, requires setup of ODBC driveribm_db2 or PDO_IBM modules (included)PDO_ODBC or odbc if 64bit, requires setup of ODBC driveribm_db2 or PDO_IBM modules (included)PDO_ODBC or odbc, requires setup of ODBC driveribm_db2 or PDO_IBM modules
(PDO_IBM module requires manual build)
Bit modes available64bit32bit (LPP)
64bit (RPM)		64bit
Compatible with Zend FrameworkYesYesYes
Can run inside a chroot-based container?Yes (doc)NoYes
Comes with 5250 management interfacesNoYesNo
Comes with preconfigured subsystems for job managementNoYesNo
Performance toolsxdebugZend Server performance toolsxdebug
Comes with Zend Server interface for deploying and monitoring applicationsNoYesNo
Computer Programming, Computing, IBMi, Web development

IBM HTTP Server For i (Apache) | IBMi v7r2 ROBOT Attack Mitigation

IBMi v7r2 ROBOT ATTACK  Mitigation

The best way to mitigate the vulnerability is to disable all SSL protocols apart from TLS 1.2. This will mean users with out of date operating systems and browsers will no longer be able to use the site but those will likely be minimal.

The Vulnerability

ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server.

In 1998, Daniel Bleichenbacher discovered that the error messages given by SSL servers for errors in the PKCS #1 v1.5 padding allowed an adaptive-chosen ciphertext attack; this attack fully breaks the confidentiality of TLS when used with RSA encryption.

Using some slight variations this vulnerability can still be used against many HTTPS hosts in today’s Internet.

https://robotattack.org/

From the 1st March 2018 Qualys SSL Labs will rate sites affected by ROBOT as F.

https://www.ssllabs.com/ssltest/analyze.html

Make the following changes to your servers http config. This can be done by editing the config file directly (EDTF) or starting the *ADMIN http server and editing from within IBM Web Administration for i (/HTTPAdmin)

The required changes should already be applied if using v7r3 and above. The changes can also be applied by changing the allowed ciphers system value (QSSLCSL) but is best to change for the application required and leave the system values to save hassle when the OS is updated (if value is not default the settings will carry over to the upgraded OS).

The following settings will allow an A+ grade on SSLlabs:-

Qualys sslLabs rating

ServerName (enables SNI) but requires SSLServerCert directive be set.

Header Strict-Transport-Security directive (required to enable HSTS – HTTP Strict Transport Security)

SSLCipherSpec directive – Must have allowed cipher for the denied ciphers to take effect.

Values which need to be changed in bold italics.

SSLEngine On
SSLAppName QIBM_HTTP_SERVER_[SERVERNAME]
SSLVersion TLSV1.2
SSLCipherSpec ALL -TLS_RSA_WITH_AES_128_CBC_SHA
SSLCipherSpec ALL -TLS_RSA_WITH_AES_128_CBC_SHA256
SSLCipherSpec ALL -TLS_RSA_WITH_AES_256_CBC_SHA
SSLCipherSpec ALL -TLS_RSA_WITH_RC4_128_MD5
SSLCipherSpec ALL -TLS_RSA_WITH_AES_128_GCM_SHA256
SSLCipherSpec ALL -TLS_RSA_WITH_AES_256_GCM_SHA384
SSLCipherSpec ALL +TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
SSLCipherSpec ALL +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
SSLCipherSpec ALL +TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
SSLCipherSpec ALL +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
ServerName servername.com
SSLServerCert Certificate_Name_In_DCM
Header set Strict-Transport-Security “max-age=31536000;includeSubDomains;preload”

Computing, Information Security, Web development

Internet Explorer 11 BREAKS Google, Outlook Web Access • The Register

Internet Explorer 11 BREAKS Google, Outlook Web Access

The Windows 8.1 train wreck rollout continues apace

via Internet Explorer 11 BREAKS Google, Outlook Web Access • The Register.

*****

So fed up of having to roll back Internet Exploder updates because Microsoft have broken compatibility again.

IE 11 kills our in house applications & sonic wall vpn. Best of all its installed automatically. Enterprise side can be blocked through WSUS. The best solution here is to move away from IE altogether.

Pushing all our suppliers to develop browser agnostic applications.

One day we may even be able to move away from Windows altogether.

Microsoft – Listen to your customers or loose them forever.