Re: FTP server authority issue

Tim,

I can see your point about QSTRUPPGM. It is a different class of
program.

I'm a little confused about the issue of creating files via put and
crtpf. I can see why IBM would want to force the put command to use the
QSYS version of the crtpf command (or any internal version that they
want to use). Put is an FTP concept that has to obey FTP rules, not
AS/400 rules. If they let you change the way FTP works with put it would
open up nasty support issues for IBM, wouldn't it? 

The command interface in FTP lets you run commands that are unique to
the particular server. You can execute the crtpf command or any other
user-written command you want. No one expects that the command interface
will work the same from one platform to another. 

Am I missing something?
Patrick

Tim McCarthy wrote:
> 
> But this is not the way it used to work. I've tried this on a V3R2 machine
> and it uses the library list to determine the command to use (CRTPF).
> Whether you are using exit points or not, you still have the exposure that
> two different authority levels exist for a single user depending on whether
> they attempt a file creation option from the command line or use the PUT
> command through the FTP server. (QSTRUPPGM doesn't fall into the same
> category of program - I would expect it to reference a reliable base set of
> commands.)
> 
> 
> At 12:00 PM 10/15/98 -0700, you wrote:
> >Hi Tim,
> >
> >It is quite common for IBM to qualify command usage to point to the QSYS
> >library. Just look at the source for QSTRUPPGM as an example. It would
> >probably take an IBM'er to really answer this question. I would suspect
> >that the proper way to secure FTP is with the exit points. Gee, who do
> >we know who has an FTP security product <g> ???
> >
> >Patrick
> >--
> >IBM AS/400 communications, FTP automation, and network security
> >software and consulting services.
> >
> >mailto:townsend@patownsend.com
> >http://www.patownsend.com
> >
> >Tim McCarthy wrote:
> >>
> >> Can anyone verify this:
> >>
> >> A customer is running the OS/400 FTP server under V4R2. They have a
> >> modified system library list that has a user library NEWSYS prior to QSYS
> >> in which they have created versions of IBM commands - one of which is
> >> CRTPF. All users have had authority revoked to the original commands in
> QSYS.
> >> When running an FTP session, users authorized to the new CRTPF command can
> >> run the command QUOTE RCMD CRTPF QGPL/myfile etc.. successfully. However
> >> when they try to use PUT to send to the file QGPL/myfile (which does not
> >> exist) they get an error "Unable to open or create target file MYFILE in
> >> library QGPL". I've checked out the FTP server job log and the library list
> >> does include NEWSYS in the library list ahead of QSYS. Interestingly the
> >> server joblog error states "Not authorized to command CRTPF in library
> >> QSYS". Has the FTP server program changed to use the CRTPF command in QSYS
> >> explicitely? If so, this would seem to be a security hole.
> >>
> >> Tim
> >> Tim McCarthy
> >> TrailBlazer Systems Inc.
> >> AS/400 E-Commerce communications
> >> +---
> >> | This is the Midrange System Mailing List!
> >> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> >> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> >> | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> >> | Questions should be directed to the list owner/operator:
> david@midrange.com
> >> +---
> >+---
> >| This is the Midrange System Mailing List!
> >| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> >| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> >| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> >| Questions should be directed to the list owner/operator: david@midrange.com
> >+---
> >
> Tim McCarthy
> TrailBlazer Systems Inc.
> AS/400 E-Commerce communications
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

-- 

IBM AS/400 communications, FTP automation, and network security
software and consulting services.

mailto:townsend@patownsend.com
http://www.patownsend.com
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---