Ports and port restrictions for DDM and DRDA

 

With the advent of new choices for the security of distributed data management (DDM) communications, the system administrator can restrict certain communications modes by blocking the ports they use. This topic discusses some of these considerations.

The DDM or DRDA^® TCP/IP server listens on port 447 (the well-known DDM port) and 446 (the well-known DRDA port) as well as 448 (the well-known SSL port). The DB2 Universal Database™ for iSeries™ implementation of DDM does not distinguish between the two ports 446 and 447, however, so both DDM and DRDA access can be done on either port.

Using the convention recommended for IPSec, the port usage for the DDM TCP/IP server follows:

• 446 for clear text data streams

• 447 for IPSec encrypted data streams (suggested)

• 448 for SSL encrypted data streams (required)

You can block usage of one or more ports at the server by using the Configure TCP/IP (CFGTCP) command. To do this, choose the Work with TCP/IP port restrictions option of that command. You can add a restriction so that only a specific user profile other than the one that QRWTLSTN runs under (normally QUSER) can use a certain port, such as 446. That effectively blocks 446. If 447 were configured for use only with IPSec, then blocking 446 would allow only encrypted data streams to be used for DDM and DRDA access over native TCP/IP. You could block both 447 and 448 to restrict usage only to SSL. It might be impractical to follow these examples for performance or other reasons (such as current limited availability of SSL-capable clients), but they are given to show the possible configurations.

 

Parent topic:

Elements of security in a TCP/IP network

 

Related reference

Configure TCP/IP (CFGTCP) command