Linux ODBC: IBM i Access Client Solutions

Download the Linux Application Package IBMiAccess_v1r1_LinuxAP.zip from IBM; this requires an IBM userID.

You do not need the base package, which contains Java applications for other functions.

https://www.ibm.com/support/pages/ibm-i-access-client-solutions

Confirm that the following dependencies are installed:

# unzip IBMiAccess_v1r1_LinuxAP.zip

# cd x86_64

# yum install ibm-iaccess-1.1.0.16-1.0.x86_64.rpm

or

# rpm -i ibm-iaccess-1.1.0.16-1.0.x86_64.rpm

The installer uses odbcinst to register the driver in /etc/odbcinst.ini

If the initial attempt to register the driver fails, try again with the following:

# odbcinst -i -d -f /opt/ibm/iaccess/unixodbcregistration

The following is added to /etc/odbcinst.ini:

[IBM i Access ODBC Driver]
Description=IBM i Access for Linux ODBC Driver
Driver=/opt/ibm/iaccess/lib/libcwbodbc.so
Setup=/opt/ibm/iaccess/lib/libcwbodbcs.so
Driver64=/opt/ibm/iaccess/lib64/libcwbodbc.so
Setup64=/opt/ibm/iaccess/lib64/libcwbodbcs.so
Threading=0
DontDLClose=1
UsageCount=1

[IBM i Access ODBC Driver 64-bit]
Description=IBM i Access for Linux 64-bit ODBC Driver
Driver=/opt/ibm/iaccess/lib64/libcwbodbc.so
Setup=/opt/ibm/iaccess/lib64/libcwbodbcs.so
Threading=0
DontDLClose=1
UsageCount=1

a typical DSN looks like:

[mysys]
Description=IBM i Access ODBC Driver
Driver=IBM i Access ODBC Driver
System=myhost
CommitMode=1
DefaultLibraries={QGPL,SQDR}

Use the cwbping command to verify that the host servers are running and accessible:

# /opt/ibm/iaccess/bin/cwbping myhost

SSL configuration

See IBM tech doc

Make SSL ODBC connections from Linux to Db2 for i
https://www.ibm.com/support/pages/make-ssl-odbc-connections-linux-db2-i

This uses stunnel: open source proxy designed to add TLS encryption functionality to existing clients and servers without any changes in the programs' code. stunnel runs on top of OpenSSL.

# yum install stunnel

# cp /opt/ibm/iaccess/doc/iaccess.stunnel.config /etc/stunnel/myhost.conf

edit /etc/stunnel/myhost.conf and configure the following

CAFILE = /etc/pki/ca-trust/source/anchors/myhost.pem

# i.e. you can use the Certificate Authority certificate that you placed here for StarSQL SSL.

verify = 2

Change the system name from the example to the actual IP address or hostname of the IBM i system

Start stunnel:

# sudo stunnel /etc/stunnel/mysys.conf

sample DSN:

[mysys-ssl]
Description=IBM i Access ODBC Driver
Driver=IBM i Access ODBC Driver
System=127.0.0.1
CommitMode=1
DefaultLibraries={QGPL,SQDR}

To verify that SSL is being used:

# ss -n | grep <IP of the i system>