Re: FTP question

["Sims, Ken" <KSIMS@xxxxxxxxxxxxxxxx>]

Hi Richard -

>Date: Tue, 29 Feb 2000 17:06:47 -0800
>From: "Richard J. Serrano" <rjs@pgsas400.com>
>Subject: Re: FTP question
>
>Agreed: It does take a valid user id & password to log onto the 
>AS/400 through FTP. BUT, when 86% of theft or misuse of data is 
>attributed to the "authorized user" with a valid user id & password, 
>they are more of a security threat than anyone cares to admit.

Well, let's make it simple.  Just disable all of the profiles on the system.
Then you'll be  safe.

Join the real world.  FTP is a standard protocol that's been around for
years and years and years.  Mentioning in an email list that a standard FTP
client can be used to access an AS/400 is not giving away any big secret.

>Disagree: Appropriate object authority to the file(s) being accessed is
needed.
>Using FTP, an authorized user has unabated access to ALL objects on the
AS/400.
>Try it. Set up a test profile, with a valid user id & password, but grant
NO 
>authority to anything on the 400.
>Then, use FTP through DOS, as outlined, and see what happens... Access to
the 
>whole enchilada...

I logged on to my AS/400 through FTP from my PC and tried to access a file
that I know that profile should not have access to.  I got the following
message ...
550 Not authorized to file QAUDJ00090 in library KSLIB.
That's copied and pasted exactly from the FTP client window.  So I don't see
the problem.

Ken
Southern Wine and Spirits of Nevada, Inc.
Opinions expressed are my own and do not necessarily represent the views of
my employer or anyone in their right mind.

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---