Re: IBM i Password reset tool

[DrFranken <midrange@xxxxxxxxxxxx>]

Issue with disabling devices only especially if you auto create them is 
that you're allowing hackers unlimited attempts and you pile on the 
devices. Now of course this would have to come from within because you 
would never allow that from the internet but viruses do exist. And so to 
cranky employees.

        - Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 6/25/2018 6:50 AM, Rob Berendt wrote:
> One has to be careful with passwords for accounts which never sign on. For
> example, accounts used to run scheduled jobs only.  You may want to start
> out with reports only and only when you feel comfortable with the outcome,
> change to automatic actions.
>
> We do not disable accounts with too many sign on's, only the device.  In
> theory one could launch a Denial Of Service attack on your system by
> looking at message queues in QUSRSYS and signing on three times with a
> password of hatethisjob (unless they find some one user with that
> password).
>
> Our message queue monitoring software does trap some of these.  Users on
> our scanning devices have real difficulties signing on.  We vary the
> device back on three times before giving up.  All automatic.
>
>
> Rob Berendt