Re: Devices created automatically

[Vernon Hamberg <vhamberg@xxxxxxxxx>]

maybe someone is TELNETting your system, then putting QUIT in the user id
field, then pressing ENTER repeatedly.

The fact that they are V100 suggests that the client is on Windows or Unix.

What is the timing on the create dates for the device descriptions?
(DSPOBJD). Also, how often are the CPF1397 messages occurring?

This looks like a security breakin attemp, maybe benign, but troublesome.

If you have all the QPADEV* devices you need for your environment, turn off
system value QAUTOVRT. ASAP.
At 10:17 AM 4/2/02 -0500, you wrote:
>This is a multi-part message in MIME format.
>--
>[ Picked text/plain from multipart/alternative ]
>Devices are being created automatically every 5 to 10 minutes on our
>AS/400 (V4R3).  We have no idea how this is happening.  This only started
>happening for the past 2 days.  We delete these devices and they come
>right back.  Email me directly if you have any
>questions:  frank.kany@burr-reid.org
>
>This is what the devices look like:
>================================================  Device
>Type        Text
>  QPADEV000B   V100        Device created for S1029348.
>QPADEV000C   V100        Device created for S1029348.
>QPADEV000D  V100        Device created for S1029348.
>QPADEV000F   V100        Device created for S1029348.
>QPADEV0001   V100        Device created for S1029348.
>QPADEV0002   V100        Device created for S1029348.
>QPADEV0003   V100        Device created for S1029348.
>QPADEV0004   V100        Device created for S1029348.
>
>We don't even have a user named "quit"
>================================================
>Message ID . . . . . . :   CPF1397
>Date sent  . . . . . . :   04/02/02      Time sent  . . . . . . :   09:34:03
>
>Message . . . . :   Subsystem QINTER varied off work station QPADEV000D for
>   user QUIT.
>
>Cause . . . . . :   The maximum number of sign on attempts specified by system
>   value QMAXSIGN has been reached.  The device has been varied off for
>   security reasons.
>Recovery  . . . :   After checking with your security officer, vary the device
>   on using the Vary Configuration (VRYCFG) command.
>
>Hope this information helps.
>=================================================
>Display Device Description
>
>Device description . . . . . . . . :   QPADEV000D
>Option . . . . . . . . . . . . . . :   *BASIC
>Category of device . . . . . . . . :   *DSP
>
>Device class . . . . . . . . . . . :   *VRT
>Device type  . . . . . . . . . . . :   V100
>Device model . . . . . . . . . . . :   *ASCII
>Emulated twinaxial device  . . . . :   3196A2
>Online at IPL  . . . . . . . . . . :   *NO
>Attached controller  . . . . . . . :   QPACTL01
>--
>
>
>_______________________________________________
>This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
>To post a message email: MIDRANGE-L@midrange.com
>To subscribe, unsubscribe, or change list options,
>visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
>or email: MIDRANGE-L-request@midrange.com
>Before posting, please take a moment to review the archives
>at http://archive.midrange.com/midrange-l.