RE: FTP with server down

["Dave George \(400times\)" <editor@xxxxxxxxxxxxxx>]

Connection refused without the FTP server started on my v4r5 box.
Sure beats conventional wisdom!


-----Original Message-----
From: midrange-l-admin@midrange.com
[mailto:midrange-l-admin@midrange.com]On Behalf Of Steve McKay
Sent: 14 September 2001 16:39
To: midrange-l@midrange.com
Subject: Re: FTP with server down



"alan shore" <SHOREA@dime.com> wrote:

"Using the command (ENDTCPSVR  SERVER(*FTP)) to ensure that no FTP server
was
running, I was able to FTP from MS DOS to the AS/400 using my AS/400 user
 profile and password. If I am NOT authorized to our FTP authorization list
, I will be denied. (EXIT programs having been installed and implemented) .
 If I AM authorized to our FTP authorization list, I can proceed, with what
 I am authorized to do, with the regular AS/400 security AND whatever
security
has been applied via the exit programs."

If this is correct, then I would think that it would be a HUGE security
hole.  It is my understanding that, if the FTP server is not running, there
is nothing 'at the other end' to even present you with a user ID/password
challenge and you get a "Connection refused" message.  I am still unable to
cause the described behavior on my V4R5 system.  Is it possible that this
occurred via the Trivial FTP server?

Curious-er,

Steve

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.