Re: Is message id TCP12AF a security risk?

select *
FROM QSYS2.MESSAGE_FILE_DATA
where Message_File_Library = 'QTCPMSG';

^ returned no rows. Hmmm.

Not a fan of message text = &1. I was going to suggest just changing the
message text for TCP12AF to "Hello" or somesuch, but with &1, who knows
what else IBM uses it for?

- Dan

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob
Berendt
Sent: Tuesday, January 9, 2024 8:31 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Is message id TCP12AF a security risk?

Originally I was thinking that the subject line was the issue. But now
I'm not so sure. Let me back up...
When I ftp from one IBM i to another, after I log in I get:
OS/400 is the remote operating system. The TCP/IP version is "V7R5M0".
If you hit help on that you will see that the message id is TCP12AF.
However, I do not get this message when I ftp from my pc dos client.
Why is this a concern? Well if nefarious people know the OS you are
running on, and the version, they may be able to focus their attack vector
more.
One thing nice is that IBM obfuscates TCP12AF and uses the name of an OS
that has long been obsoleted.
Actually if you do DSPMSGD RANGE(TCP12AF) MSGF(QTCPMSG) you will see that
the whole content of the message is data returned to it by the remote
server.

Thus the question really becomes: how do I stop my IBM i from supplying
the OS name and it's version?

I tried querying every message file on the system to see if that is where
this is stored by running this:
select *
FROM QSYS2.MESSAGE_FILE_DATA
where MESSAGE_TEXT LIKE '%OS/400%' AND MESSAGE_TEXT LIKE '%V7R5M0%';

But it didn't find any hits.

There may be legal reasons why you do not want to publish the version of
the OS. NDA possibly.

*** CONFIDENTIALITY NOTICE: The information contained in this
communication may be confidential, and is intended only for the use of the
recipients named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution, or
copying of this communication, or any of its contents, is strictly
prohibited. If you have received this communication in error, please return
it to the sender immediately and delete the original message and any copy
of it from your computer system. If you have any questions concerning this
message, please contact the sender. ***
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.