RE: RE: QUSRWRK Question

At 03:57 PM 06/16/2000 -0500, you wrote:

Well, possibly someone else is trying to hack the password?  Other than 
that, I'm stumped.  We need the help of a security guru!

John Earl, where are we when we need you now?

Al


>Al,
>
>That is the "phantom" part of the equation. This particular user sits next
>to me. He had not even arrived at the office and turned on his PC when the
>first occurance of the message happened nor was his PC even powered on.
>
>Nick
>
>-----Original Message-----
>From: Al Barsa, Jr. [mailto:barsa2@ibm.net]
>Sent: Friday, June 16, 2000 3:02 PM
>To: midrange-L@midrange.com
>Subject: Fwd: RE: QUSRWRK Question
>
>
>Nick,
>
>The second level text is the give away.  This user has entered an invalid
>password a number of times that he/she has exceeded the system value
>QMAXSIGN.  This implies that you have the system value QMAXSGNACN set to
>either 2 or 3.
>
>This is covered in the work management guide.  I do a presentation at
>COMMON called Everything You Always Wanted to Know about System Values (but
>were afraid to ask), and I'll be happy to forward a .PDF to anyone who is
>interested.  Please send me private mail at my private e-mail address as
>listed in the signature.
>
>Al
>
>
>
>
> >From: "Mart, Nick" <Nick.Mart@kingland.com>
> >To: "'barsa2@ibm.net'" <barsa2@ibm.net>
> >Subject: RE: QUSRWRK Question
> >Date: Fri, 16 Jun 2000 13:17:09 -0500
> >X-Mailer: Internet Mail Service (5.5.2232.9)
> >
> >Al,
> >
> >Here's an example of the message detail.
> >
> >Message ID . . . . . . :   CPF1393       Severity . . . . . . . :   70
> >
> >Message type . . . . . :   Information
> >
> >Date sent  . . . . . . :   06/16/00      Time sent  . . . . . . :
>09:54:22
> >
> >
> >
> >Message . . . . :   Subsystem QUSRWRK disabled user profile JKING on device
> >
> >   *N.
> >
> >Cause . . . . . :   User profile JKING has been disabled because the
>maximum
> >
> >   number of sign-on attempts specified for the QMAXSIGN system value has
> >been
> >   reached.
> >
> >Recovery  . . . :   To enable the user profile, have the security officer
> >
> >   change the STATUS parameter to *ENABLED on the Change User Profile
> >
> >   (CHGUSRPRF) command.
> >
> >
> >
> >Thanks,
> >
> >Nick
> >
> >Al Barsa, Jr. [barsa2@ibm.net]
> >
> >-----Original Message-----
> >From: Al Barsa, Jr. [mailto:barsa2@ibm.net]
> >Sent: Friday, June 16, 2000 11:38 AM
> >To: MIDRANGE-L@midrange.com
> >Subject: Re: QUSRWRK Question
> >
> >
> >At 10:46 AM 06/16/2000 -0500, you wrote:
> >
> >Please provide the message ID.
> >
> >Al
> >
> >
> > >We are experiencing a "phantom" problem. We are getting a CPF1393 message
> >on
> > >QSYSMSG stating, "Subsystem QUSRWRK disabled user profile XYZ on device
> >*N."
> > >
> > >
> > >It does not appear that this user is trying to access the machine. We
>have
> > >tried the FTP process. The disabling in the FTP process comes through the
> > >QSYSWRK subsystem. Our operations staff is getting swamped with these
> > >messages.
> > >
> > >If anyone on the list has suggestions on what to do to track this down,
>it
> > >would be greatly appreciated.
> > >
> > >Thanks in advance!
> > >
> > >Nick Mart
> > >Kingland Systems
> > >nick.mart@kingland.com
> > >+---
> > >| This is the Midrange System Mailing List!
> > >| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> > >| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> > >| To unsubscribe from this list send email to
> >MIDRANGE-L-UNSUB@midrange.com.
> > >| Questions should be directed to the list owner/operator:
> >david@midrange.com
> > >+---
> >
> >
> >
> >+--------------------------------------------------+
> >| Please do not send private mail to this address. |
> >| Private mail should go to barsa@ibm.net.         |
> >+--------------------------------------------------+
> >
> >Al Barsa, Jr. - Account for Midrange-L
> >Barsa Consulting, LLC.
> >400 > 390
> >
> >Phone:          914-251-1234
> >Fax:            914-251-9406
> >http://www.barsaconsulting.com
> >http://www.taatool.com
> >
> >+---
> >| This is the Midrange System Mailing List!
> >| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> >| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> >| To unsubscribe from this list send email to
>MIDRANGE-L-UNSUB@midrange.com.
> >| Questions should be directed to the list owner/operator:
> >david@midrange.com
> >+---
>
>
>
>+--------------------------------------------------+
>| Please do not send private mail to this address. |
>| Private mail should go to barsa@ibm.net.         |
>+--------------------------------------------------+
>
>Al Barsa, Jr. - Account for Midrange-L
>Barsa Consulting, LLC.
>400 > 390
>
>Phone:          914-251-1234
>Fax:            914-251-9406
>http://www.barsaconsulting.com
>http://www.taatool.com
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator:
>david@midrange.com
>+---
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
>| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com
>+---



+--------------------------------------------------+
| Please do not send private mail to this address. |
| Private mail should go to barsa@ibm.net.         |
+--------------------------------------------------+

Al Barsa, Jr. - Account for Midrange-L
Barsa Consulting, LLC.  
400 > 390

Phone:          914-251-1234
Fax:            914-251-9406
http://www.barsaconsulting.com
http://www.taatool.com

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---