Re: BugTraq Exploit for OS/400

[rob@xxxxxxxxx]

Are you asking me to elaborate on:
> We store the employee number in the job accounting field.  Hooks into our
> HR software.  If we get a notice of termination it get's acted upon
pretty
> quickly.

If so, ok.  When we create a user profile we enter the employee number into
the job accounting field.  Same position all the time.  Then a HR program
checks this against terminated employees.

Rob Berendt
--
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
Benjamin Franklin



                    Chuck Lewis
                    <clewis@iquest.net>       To:     midrange-l@midrange.com
                    Sent by:                  cc:
                    midrange-l-admin@mi       Fax to:
                    drange.com                Subject:     Re: BugTraq Exploit 
for OS/400


                    02/25/2002 03:43 PM
                    Please respond to
                    midrange-l






Can you elaborate on this Rob ?

I'm assuming some program does this ?

Chuck

rob@dekko.com wrote:

> The ANZDFTPWD is effective for those with default passwords.
>
> For everyone you can do a DSPUSRPRF to an outfile.  Then you can Query
> that.
>
> We store the employee number in the job accounting field.  Hooks into our
> HR software.  If we get a notice of termination it get's acted upon
pretty
> quickly.
>
> Rob Berendt
> --
> "They that can give up essential liberty to obtain a little temporary
> safety deserve neither liberty nor safety."
> Benjamin Franklin
>
>                     "Wills, Mike N.
>                     (TC)"                     To:
"'midrange-l@midrange.com'" <midrange-l@midrange.com>
>                     <MNWills@taylorcorp       cc:
>                     .com>                     Fax to:
>                     Sent by:                  Subject:     RE: BugTraq
Exploit for OS/400
>                     midrange-l-admin@mi
>                     drange.com
>
>                     02/25/2002 03:11 PM
>                     Please respond to
>                     midrange-l
>
> How do you get that list?
>
> I will also list user profiles and look at the date last signed on, and
if
> it's over a month see if we need to delete the account.
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.