Re: FTP question

But I get the message 
Not authorized to file xxxx in library xxx
When I tried to ftp get a file with *public set to *exclude

There was a conflict in your paragraph.  'an authorized user' competes with 
'grant NO authority'.

Perhaps your FTP exit point adopts authority or changes the user profile to 
another user profile on the system.  A documented feature to accomodate 
anonymous ftp.





rjs@pgsas400.com on 02/29/2000 08:37:50 PM
Please respond to MIDRANGE-L@midrange.com@Internet
To:     MIDRANGE-L@midrange.com@Internet
cc:      
Fax to: 
Subject:        Re: FTP question

Agreed: It does take a valid user id & password to log onto the AS/400 through 
FTP.
BUT, when 86% of theft or misuse of data is attributed to the "authorized user" 
with a valid
user id & password, they are more of a security threat than anyone cares to 
admit.

Disagree: Appropriate object authority to the file(s) being accessed is needed.
Using FTP, an authorized user has unabated access to ALL objects on the AS/400. 
Try it.
Set up a test profile, with a valid user id & password, but grant NO authority 
to anything on
the 400.
Then, use FTP through DOS, as outlined, and see what happens... Access to the 
whole enchilada...

Again, JMHO

Rich




----- Original Message -----
From: Sims, Ken <KSIMS@SOUTHERNWINE.com>
To: <MIDRANGE-L@midrange.com>
Sent: Tuesday, February 29, 2000 4:14 PM
Subject: Re: FTP question


> Hi Richard -
>
> >Date: Tue, 29 Feb 2000 14:18:30 -0800
> >From: "Richard J. Serrano" <rjs@pgsas400.com>
> >Subject: Re: FTP question
> >
> >Whoa!
> >
> >Doesn't this outline, step-by-step, how to "backdoor" an AS/400
> >from a PC? Perhaps a bit more discretion and security awareness
> >should be exercised before posting something like this?
>
> Huh???????
>
> It still takes a valid user-id and password to log on to the AS/400 through
> FTP, and the appropriate object authority to the file(s) being accessed.  I
> wouldn't call that a "back door".
>
> Ken
> Southern Wine and Spirits of Nevada, Inc.
> Opinions expressed are my own and do not necessarily represent the views of
> my employer or anyone in their right mind.
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---
>

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---