Setting Up a BRMS Network

Perform the following steps to enable a BRMS networked system for TCP/IP operations.

BRMS network communications requires TCP/IP communications and relational database (RDB) entries for all of its network operations
which must be configured by your site security administrator. BRMS does not set up communication or create the necessary system
configurations. BRMS expects that the communication setup has been done by the site security administrator.

Step 1: Check TCP/IP

Use the following command to verify TCP/IP is running on each of the systems in the BRMS network:

PING RMTSYS(remote-system-name)

If TCP/IP is not running, then you will need to configure and/or start TCP/IP.

Step 2: SET TCP/IP DDM Connection Security

DDM connection security must be configured as described below before the FROMSYS() parameter on BRMS commands will function properly.

You need to determine whether you intend to use secured or non-secured DDM connections to the remote systems in the BRMS network. In order to use a non-secured DDM connection, the user id must exist on the remote system, although the user's password will not be validated. To use a secured DDM connection the user id and password must be the same on both the local and remote systems. You may want to review this setup with your site security administrator before taking specific actions.

BRMS strongly encourages the use of Secured DDM connections and implementing passwords for the Relational Database Directory Entries used for DB2 for i call level interface (CLI) communications.

For Secured DDM connection

Use one of the following commands to change the TCP/IP DDM attributes for secured operations:

• CHGDDMTCPA PWDRQD(*YES)

• CHGDDMTCPA PWDRQD(*USRIDPWD)

Automated secure TCP/IP DDM operations are not possible if authentication passwords cannot be stored. Use the following command to change the QRETSVRSEC system value so that passwords used for authentication can be stored on the system:

CHGSYSVAL QRETSVRSEC VALUE('1')

Preferred Server Authentication support

A special value QDDMDRDASERVER is allowed for DDM and DRDA connections. You may specify QDDMDRDASERVER in the SERVER parameter of Add Server Authentication Entry (ADDSVRAUTE) command. This special value allows a user to make DDM or DRDA connections to any system in the TCP/IP network via a common userid and password. This prevents having to add individual server authentication entries for every DRDA application server in every user profile on the system. For DRDA or RDB DDM files, this resolves the problem of having to add new server authentication entries for every user profile each time a new system has been added to the TCP/IP network.

Use the following command to add server authentication entries for each user who will be authorized to perform secured TCP/IP operations to the remote systems:

ADDSVRAUTE USRPRF(user-profile) SERVER(QDDMDRDASERVER) USRID(remote-system-userid) PASSWORD(remote-system-password)

NOTE: "QDDMDRDASERVER" must be uppercase.

Use the following command to add a server authentication entry for the QBRMS user profile. (This user profile is used for network synchronization. )

ADDSVRAUTE USRPRF(QBRMS) SERVER(QDDMDRDASERVER) USRID(remote-system-userid) PASSWORD(remote-system-password)

NOTE: "QDDMDRDASERVER" must be uppercase.

Use the following command to remove server authentication entries for QDDMSERVER for each user who was authorized to perform secured TCP/IP operations to the remote systems:

RMVSVRAUTE USRPRF(user-profile) SERVER(QDDMSERVER)

NOTE: "QDDMSERVER" must be uppercase.

Use the following command to remove the QDDMSERVER server authentication entry for the QBRMS user profile.

RMVSVRAUTE USRPRF(QBRMS) SERVER(QDDMSERVER)

NOTE: "QDDMSERVER" must be uppercase.

Use the following command to remove the BRMS DDM profile.

INZBRM OPTION(*SECUREDDM) ACTION(*REMOVE)
 

If the remote-system-userid does not have *ALLOBJ special authority then the user should have QBRMS as a group profile and special authority must be *NONE. Use the following command on the remote system to change the user's profile.

CHGUSRPRF USRPRF(remote-system-userid) GRPPRF(QBRMS)
 

In addition, the remote system user should have *USE authority to the CRTDDMF command on the current system.

A server authorization entry can be removed using the RMVSVRAUTE command or changed using the CHGSVRAUTE command. See the CL Reference manual for a complete description of these commands and command parameters.

NOTES:

1. There can only be one server authorization entry for a user no matter what remote system is specified. This means that for a user to access multiple systems in the network, that user's id and password must be the same on all BRMS networked systems.

2. Do not use user profile QBRMS for the remote system userid. Create a new user profile and specify user profile QBRMS for the Group profile (GRPPRF) parameter of the remote system user profile. Use this new remote system userid for the User ID (USRID) parameter of the Add Server Authentication Entry (ADDSVRAUTE) command.

Go to step 3.

For Non-secured DDM connections

Use one of the following commands to change the TCP/IP DDM attributes for non-secured operations:

• CHGDDMTCPA PWDRQD(*NO)

• CHGDDMTCPA PWDRQD(*USRID)

If you are going from a secured DDM connection to a non-secured DDM connection make sure to remove the server authentication entries. Use the commands to remove server Authentication entries for each user

• RMVSVRAUTE USRPRF(user-profile) SERVER(QDDMSERVER)

• RMVSVRAUTE USRPRF(user-profile) SERVER(QDDMDRDASERVER)

NOTE: "QDDMSERVER" and "QDDMDRDASERVER" must be uppercase.

Step 3: Configure the TCP/IP DDM Server Automatic Restart

Use the following command to change the TCP/IP DDM server attributes if you want the server automatically started when TCP/IP is started:

CHGDDMTCPA AUTOSTART(*YES)

Step 4: Starting and Ending the DDM Server

Use the following command to end the TCP/IP DDM server if you changed any of the attributes:

ENDTCPSVR SERVER(*DDM)

Use the following command to start the TCP/IP DDM server:

STRTCPSVR SERVER(*DDM)

Step 5: Enable BRMS to use TCP/IP

Take the following action to enable BRMS to use TCP/IP

1. WRKPCYBRM TYPE(*SYS)

2. Select option 4 to Change network group

3. Enter *YES in Enable for TCP/IP and press Enter.

Step 6: Setup BRMS network.

Refer to the BRMS User Guide, Chapter 14 Networking with BRMS (or the IBM i Knowledge Center page Networking with BRMS) for instructions on how to set up a BRMS network. 

Step 7: Set up a secure DDM profile for BRMS to use.

NOTE: Skip Step 7 if using the Preferred Server Authentication support with QDDMDRDASERVER.

You can use the following BRMS command on one of the systems in the BRMS network to set the user profile and password to use for remote server secure DDM connections to all the systems in the BRMS network. To set the user profile:

INZBRM OPTION(*SECUREDDM) ACTION(*SET) USER(xxxxx) PASSWORD()

Note: The INZBRM OPTION(*SECUREDDM) command requires *SECADM special authority. It is recommended that the user profile entered on the ACTION(*SET) be the same user profile that was entered for the QDDMSERVER server authentication entry for the QBRMS user profile in Step 2 instructions For secure DDM connection. The user profile and password must exist and be the same on the local and remote systems.