Re: ANZDFTPWD with *SIGNOFF

Tommy,
Do you try some of the stuff you recommend? :-)
Someone who is disabled cannot use ftp. I just tried it. Soon as I ran
CHGUSRPRF USRPRF(DUMMY) STATUS(*ENABLED) they were able to ftp.
INLMNU(*SIGNOFF) isn't a bad idea.
LMTCPB(*YES) is probably a good idea unless that user profile needs to
fire off commands from ftp like QUOTE RCMD ...
IBM only started respecting LMTCPB with ftp some releases back. ODBC and
others still don't restrict commands based on the value of LMTCPB.

Is anonymous ftp really that bad? Think about it. There's probably a
million sites that support it. Including IBM. The big thing about ftp is
to NOT allow upload and download from the same directory. That's what the
hackers are looking for. We have different directories for upload from
download. What's the thrill of putting naughty stuff or music on a site
if you can never retrieve them - ever? Can you do a DOS attack? Probably
but, again, there are techniques (remember, lots of anonymous ftp is out
there). When you use FTP your exit point takes the anonymous id and
assigns it to a real id. That real id can have a MAXSTG assigned to it.
Maybe anonymous ftp is more secure? After all, can you use that same
anonymous id for 5250, ODBC, etc? Not unless you specifically grant it
with exit points. However, can you use a regular WRKUSRPRF id for all
those applications? Yes, unless you specifically DENY it with exit
points. The outside people who use our ftp site are not given id's that
you can find with WRKUSRPRF. They are given id's that are mapped to an id
(or id's) that you can find with WRKUSRPRF. So you could sign on as
tommy@xxxxxxxxxxxxx with some assigned password and that might be mapped
to XYZ00001.


Rob Berendt