Re: Checking the validity of AS400 login details

What's your point?

You can disable any profile you know the name to for any server...

Charles



On Thu, Aug 27, 2009 at 1:00 PM, Walden H.
Leverich<WaldenL@xxxxxxxxxxxxxxx> wrote:

That's right. Doing it remotely I only need the
AS400 address to make an AS400 object to validate user:

Interesting.... so what would happen if you coded this?

AS400 as400 = new AS400();

try {
   as400.setSystemName("as400-ip");
   for(int =0; i<100; i++)
       boolean ok = as400.validateSignon('QSECOFR', 'WRONGPASSWORD');
}
catch (Exception  exc) {
  errors = exc.getMessage();
}


Seems like a DOS attack to me. I can disable any user profile on the
system I want to. :-) Granted you could just go to a signon screen and
type in the same thing, but this seems "easier" to do.

-Walden

--
Walden H Leverich III
Tech Software &
BEC - IRBManager
(516) 627-3800 x3051
WaldenL@xxxxxxxxxxxxxxx
http://www.TechSoftInc.com
http://www.IRBManager.com

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)
--
This is the Java Programming on and around the iSeries / AS400 (JAVA400-L) mailing list
To post a message email: JAVA400-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/java400-l
or email: JAVA400-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/java400-l.