Re: Security Password violation?

[thomas@xxxxxxxxxxx]

Antonio:

On Tue, 20 November 2001, afvaiv wrote:

> Hi, quite often one of our people gets his User disabled... I've
> activated
> Auditing, and after any of these occassions I can see (DSPAUDJRNE  with
> type PW) that there were some attempts to use his userID and a failing
> Password.
>
> But the audit journal entry gives no more info than date and time...

Unfortunately, even if you display the actual PW entries with DSPJRN, you won't 
get much more info than this. However, if you display all QAUDJRN entries for 
maybe a second or two just before the PW entry, you should see a number of 
related entries that might give you what you need.

> I've considered writing my own ExitProgram for the SignOnServer, but was
> hoping there'll be a direct way of getting that info without having to
> reinvent the wheel?

By looking at the Host Servers info for the Signon server, you'll quickly see 
that you won't have access to anything much more than what you see in the PW 
journal entry. Writing the exit program isn't very difficult; but turning it 
into a useful program takes a lot of effort. I don't think this exit program is 
worth your time.

Tom Liotta

--
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788
Fax  253-872-7904
http://www.400Security.com


___________________________________________________
The ALL NEW CS2000 from CompuServe
 Better!  Faster! More Powerful!
 250 FREE hours! Sign-on Now!
 http://www.compuserve.com/trycsrv/cs2000/webmail/