Re: Devices created automatically

["Jim Franz" <franz400@xxxxxxxxxxxx>]

someone is using telnet to your 400, and the qautovrt is creating devices
check system value QAUTOVRT.
If you already have devices created that you need, count them up, and set
this
value so that no more are created.
definitely not *nomax
even though QUIT not a valid user id, os400 has to give a valid device so
sign on attempt can be made

The NETSTAT cmd & option 3 should show ip address of attempt

jim

(this may be innocent - user not knowing what to do) or a hack attempt

----- Original Message -----
From: "Frank W. Kany IV" <frank.kany@burr-reid.org>
To: <midrange-l@midrange.com>
Sent: Tuesday, April 02, 2002 10:17 AM
Subject: Devices created automatically


This is a multi-part message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
Devices are being created automatically every 5 to 10 minutes on our AS/400
(V4R3).  We have no idea how this is happening.  This only started happening
for the past 2 days.  We delete these devices and they come right back.
Email me directly if you have any questions:  frank.kany@burr-reid.org

This is what the devices look like:
================================================  Device
Type        Text
 QPADEV000B   V100        Device created for S1029348.
QPADEV000C   V100        Device created for S1029348.
QPADEV000D  V100        Device created for S1029348.
QPADEV000F   V100        Device created for S1029348.
QPADEV0001   V100        Device created for S1029348.
QPADEV0002   V100        Device created for S1029348.
QPADEV0003   V100        Device created for S1029348.
QPADEV0004   V100        Device created for S1029348.

We don't even have a user named "quit"
================================================
Message ID . . . . . . :   CPF1397
Date sent  . . . . . . :   04/02/02      Time sent  . . . . . . :   09:34:03

Message . . . . :   Subsystem QINTER varied off work station QPADEV000D for
  user QUIT.

Cause . . . . . :   The maximum number of sign on attempts specified by
system
  value QMAXSIGN has been reached.  The device has been varied off for
  security reasons.
Recovery  . . . :   After checking with your security officer, vary the
device
  on using the Vary Configuration (VRYCFG) command.

Hope this information helps.
=================================================
Display Device Description

Device description . . . . . . . . :   QPADEV000D
Option . . . . . . . . . . . . . . :   *BASIC
Category of device . . . . . . . . :   *DSP

Device class . . . . . . . . . . . :   *VRT
Device type  . . . . . . . . . . . :   V100
Device model . . . . . . . . . . . :   *ASCII
Emulated twinaxial device  . . . . :   3196A2
Online at IPL  . . . . . . . . . . :   *NO
Attached controller  . . . . . . . :   QPACTL01
--


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.