Security considerations for using SLIP

TCP/IP support includes Serial Interface Line Protocol (SLIP).

SLIP provides low-cost point-to-point connectivity. A SLIP user can connect to a LAN or a WAN by establishing a point-to-point connection with a system that is part of the LAN or WAN. SLIP runs on an asynchronous connection. You can use SLIP for dial-up connection to and from iSeries™ servers.

For example, you might use SLIP to dial in from your PC to an iSeries system. After the connection is established, you can use the TELNET application on your PC to connect to the iSeries TELNET server. Or, you can use the FTP application to transfer files between the two systems.

No SLIP configuration exists on your system when it ships. Therefore, if you do not want SLIP (and dial-up TCP/IP) to run on your system, do not configure any configuration profiles for SLIP. You use the Work with TCP/IP Point-to-Point (WRKTCPPTP) command to create SLIP configurations. You must have *IOSYSCFG special authority to use the WRKTCPPTP command.

If you want SLIP to run on your system, you create one or more SLIP (point-to-point) configuration profiles. You can create configuration profiles with the following operating modes:

Dial in (*ANS)
Dial out (*DIAL)

Note: A user profile is system object that allows signon. Every system job must have a user profile to run. A configuration profile stores information that is used to establish a SLIP connection with an iSeries system. When you start a SLIP connection to iSeries servers, you are simply establishing a link. You have not yet signed on and started an iSeries server job. Therefore, you do not necessarily need a user profile to start a SLIP connection to iSeries servers. However, as you will see in the discussions that follow, the SLIP configuration profile may require a user profile to determine whether to allow the connection.

Secure dial-in SLIP connections
Before someone can establish a dial-in connection to your system with SLIP, you must start a SLIP *ANS configuration profile.
Prevent dial-in users from accessing other systems
Depending on your system and network configuration, a user who starts a SLIP connection might be able to access another system in your network without signing on to your system.
Control dial-out sessions
Before someone can use SLIP to establish a dial-out connection from your system, you must start a SLIP *DIAL configuration profile.
Secure dial-out sessions
Users on your iSeries system might want to establish dial-out connections to systems that require user validation.

Parent topic: Set up TCP/IP security