RE: Mochasoft security hole

The problem you are seeing is an undesirable side-effect of the way TN5250
is handled by the AS400.  The QPADEV* devices are dynamically assigned
whenever a connect request is processed.  Even though you varied off the
device, when they reset their session, a different device will be selected
and they get another sign on screen.  Probably your best line of defense for
this would be one of the telnet initialization exit points, which could
block telnet requests from troublesome IP addresses.  Are you using any
network security tools, such as Powerlock?  You may want to consider
something like this to help you control access to your system.

Eric DeLong
Sally Beauty Company
MIS-Sr. Programmer/Analyst
940-898-7863 or ext. 1863



-----Original Message-----
From: glea@dextermag.com [mailto:glea@dextermag.com]
Sent: Wednesday, November 14, 2001 1:22 PM
To: MIDRANGE-L@midrange.com
Subject: Mochasoft security hole




We are using Mochasoft for some of our access to the AS/400 both internally
and
externally.  We have the system set up so that it will vary off the device
if
the user keys the incorrect password three times.  We tried a little test
yesterday and found that if the user selects "reset terminal" from the
"Edit"
drop down menu the device will be varied back on and a signon screen will
reappear!  This happens even if the systems administrator has varied off the
device manually.  Has anyone else had this experience and if so, how did you
deal with it?

Gary Lea


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.