RE: FTP with server down

["alan shore" <SHOREA@xxxxxxxx>]

Just to make sure I'm not going nuts (my wife and daughter would argue that 
point) I just tried it again. Submitted the command ENDTCPSVR  SERVER(*FTP), 
and verified that there was/were no FTP servers active. Tried to FTP from 
MS-DOS. Lo and behold connection.
As I'm fairly new to FTP on the AS/400 I assumed this was normal. Because of 
the replies on this particular thread, this needs to be investigated.
I will let you know of any discoveries.
Thanks all.

>>> "Dave George (400times)" <editor@400times.co.uk> 09/14/01 11:51AM >>>
Connection refused without the FTP server started on my v4r5 box.
Sure beats conventional wisdom!


-----Original Message-----
From: midrange-l-admin@midrange.com
[mailto:midrange-l-admin@midrange.com]On Behalf Of Steve McKay
Sent: 14 September 2001 16:39
To: midrange-l@midrange.com
Subject: Re: FTP with server down



"alan shore" <SHOREA@dime.com> wrote:

"Using the command (ENDTCPSVR  SERVER(*FTP)) to ensure that no FTP server
was
running, I was able to FTP from MS DOS to the AS/400 using my AS/400 user
 profile and password. If I am NOT authorized to our FTP authorization list
, I will be denied. (EXIT programs having been installed and implemented) .
 If I AM authorized to our FTP authorization list, I can proceed, with what
 I am authorized to do, with the regular AS/400 security AND whatever
security
has been applied via the exit programs."

If this is correct, then I would think that it would be a HUGE security
hole.  It is my understanding that, if the FTP server is not running, there
is nothing 'at the other end' to even present you with a user ID/password
challenge and you get a "Connection refused" message.  I am still unable to
cause the described behavior on my V4R5 system.  Is it possible that this
occurred via the Trivial FTP server?

Curious-er,

Steve

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.