Re: Devices created automatically

["Jim Franz" <franz400@xxxxxxxxxxxx>]

... a little more...
once you set qautovrt to the max #devices, don't delete the created devices.
the system will just create more, up to the max number. you can, once all
your virtuals you need exist, set value to zero.
however, this still does not stop an unauthorized attempt. as long as an
unused virtual device exists, user will get xx attempts, fail, and then get
next virtual available to try again.
in netstat it looks like this:
66.26.125.173    1580       telnet     000:00:20  Time-wait
dsplog qhst won't show ip address until successful signon
if you have capability at router to block selected ip - do it. But i would
block like 66.26.1xx.xxx and take out a whole range. if they are thru isp,
address could change.
suggest you review your "easy" user id & passwords immediately.
jim

----- Original Message -----
From: "Frank W. Kany IV" <frank.kany@burr-reid.org>
To: <midrange-l@midrange.com>
Sent: Tuesday, April 02, 2002 10:17 AM
Subject: Devices created automatically


This is a multi-part message in MIME format.
--
[ Picked text/plain from multipart/alternative ]
Devices are being created automatically every 5 to 10 minutes on our AS/400
(V4R3).  We have no idea how this is happening.  This only started happening
for the past 2 days.  We delete these devices and they come right back.
Email me directly if you have any questions:  frank.kany@burr-reid.org

This is what the devices look like:
================================================  Device
Type        Text
 QPADEV000B   V100        Device created for S1029348.
QPADEV000C   V100        Device created for S1029348.
QPADEV000D  V100        Device created for S1029348.
QPADEV000F   V100        Device created for S1029348.
QPADEV0001   V100        Device created for S1029348.
QPADEV0002   V100        Device created for S1029348.
QPADEV0003   V100        Device created for S1029348.
QPADEV0004   V100        Device created for S1029348.

We don't even have a user named "quit"
================================================
Message ID . . . . . . :   CPF1397
Date sent  . . . . . . :   04/02/02      Time sent  . . . . . . :   09:34:03

Message . . . . :   Subsystem QINTER varied off work station QPADEV000D for
  user QUIT.

Cause . . . . . :   The maximum number of sign on attempts specified by
system
  value QMAXSIGN has been reached.  The device has been varied off for
  security reasons.
Recovery  . . . :   After checking with your security officer, vary the
device
  on using the Vary Configuration (VRYCFG) command.

Hope this information helps.
=================================================
Display Device Description

Device description . . . . . . . . :   QPADEV000D
Option . . . . . . . . . . . . . . :   *BASIC
Category of device . . . . . . . . :   *DSP

Device class . . . . . . . . . . . :   *VRT
Device type  . . . . . . . . . . . :   V100
Device model . . . . . . . . . . . :   *ASCII
Emulated twinaxial device  . . . . :   3196A2
Online at IPL  . . . . . . . . . . :   *NO
Attached controller  . . . . . . . :   QPACTL01
--


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.