RE: FTP with server down

This is a multipart message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
Try again after also doing an;
ENDTCPSVR *TFTP
Just a thought, as I can't get away with doing this on our system to see
where the hole could be.

Steven Donnellan
AS/400 Systems Manager
IBM Certified Specialist - AS/400 Professional Operator
Simon Jersey Ltd

http://www.simonjersey.com




"alan shore" <SHOREA@dime.com>
Sent by: midrange-l-admin@MIDRANGE.COM
14/09/01 17:01
Please respond to midrange-l


        To:     <midrange-l@midrange.com>
        cc:
        Subject:        RE: FTP with server down


Just to make sure I'm not going nuts (my wife and daughter would argue
that point) I just tried it again. Submitted the command ENDTCPSVR
SERVER(*FTP), and verified that there was/were no FTP servers active.
Tried to FTP from MS-DOS. Lo and behold connection.
As I'm fairly new to FTP on the AS/400 I assumed this was normal. Because
of the replies on this particular thread, this needs to be investigated.
I will let you know of any discoveries.
Thanks all.

>>> "Dave George (400times)" <editor@400times.co.uk> 09/14/01 11:51AM >>>
Connection refused without the FTP server started on my v4r5 box.
Sure beats conventional wisdom!


-----Original Message-----
From: midrange-l-admin@midrange.com
[mailto:midrange-l-admin@midrange.com]On Behalf Of Steve McKay
Sent: 14 September 2001 16:39
To: midrange-l@midrange.com
Subject: Re: FTP with server down



"alan shore" <SHOREA@dime.com> wrote:

"Using the command (ENDTCPSVR  SERVER(*FTP)) to ensure that no FTP server
was
running, I was able to FTP from MS DOS to the AS/400 using my AS/400 user
 profile and password. If I am NOT authorized to our FTP authorization
list
, I will be denied. (EXIT programs having been installed and implemented)
.
 If I AM authorized to our FTP authorization list, I can proceed, with
what
 I am authorized to do, with the regular AS/400 security AND whatever
security
has been applied via the exit programs."

If this is correct, then I would think that it would be a HUGE security
hole.  It is my understanding that, if the FTP server is not running,
there
is nothing 'at the other end' to even present you with a user ID/password
challenge and you get a "Connection refused" message.  I am still unable
to
cause the described behavior on my V4R5 system.  Is it possible that this
occurred via the Trivial FTP server?

Curious-er,

Steve

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--