Re: Slew of FTP Jobs

On 25-Oct-2011 08:19 , Jerry C. Adams wrote:

I have a slew of FTP jobs that started for the most part on Wednesday
(19 October) at about 0300, I copied the WRKACTJOB panels below with
the date each was submitted to the right and, where applicable, other
clones that it submitted listed under it.

We do not have anything in the job scheduler set to run at 0300.

I, also, included a typical joblog after that.

First, what are all of these FTP jobs? They look like port scans to
me, but I am no expert.

FTP server jobs, servicing client FTP requests, though some only or also for starting new jobs to handle detected volume of incoming FTP requests beyond what are already being serviced.

Second, will ENDTCPSVR *FTP end them?

Yes.

Job User Type CPU % Function Status
QTFTP01402 QTCP BCH .0 DEQW 5-30-11 10:06

<<SNIPped bunch of QTFTP##### jobs in list>>

Part of a typical joblog:

Job 037119/QTCP/QTFTP01546 started on 10/19/11 at 03:04:18 in subsystem
QSYSWRK in QSYS. Job entered system on 10/19/11 at 03:04:18.
Job 037119/QTCP/QTFTP01546 submitted.
0 DDM conversations ended, 0 remain active.
Object changed for QTEMP in QSYS type *LIB.
SSL socket operation received return code -93. [TCP3D2C]
FTP problem when using the QsyCheckUserFunctionUsage API. [TCP3D08]
SSL socket operation received return code -93.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.


Meaning: -93 SSL is not available for use.

The "0 DDM" and the next line do not usually show up.

I seem to recall the DDM conversations and QTEMP library change messages are from the job "reuse" activity; to recycle the job without an actual end would require ending any DDM activity from the work performed in a prior established session. I tried to get the FTP components to rid of the messing with QTEMP, moving any requirements into WM processing, but had no luck; was still there in v5r4 IIRC. As long as an actual FTP session is never established, the job can keep rejecting requests... before eventually being recycled.

Auditing might help to see the user names which were rejected... though possibly not on v5r1 without the appropriate PTF; oddly the APAR was neither HIPer nor Security\Integrity flagged:
http://www-01.ibm.com/support/docview.wss?uid=nas233f451ed6055f6ed86256eb7003cab05

Regards, Chuck