Re: Devices created automatically

Frank,
If you already came to the conclusion, that it might be a hacking problem,
you should react now:
- take down the FTP server, if you don't need it at this moment, it's easy to
"quote" remote commands through it ...
- tell your users not to sign off form their PC's, watch their connections and
delete everything else which was created under the QPACTL01 controller.
- turn off QAUTOVRT
- block the incoming ip-connection at your firewall / packetfilter level.

HTH, Philipp Rusch

"Frank W. Kany IV" schrieb:

> This is a multi-part message in MIME format.
> --
> [ Picked text/plain from multipart/alternative ]
> Devices are being created automatically every 5 to 10 minutes on our AS/400 
>(V4R3).  We have no idea how this is happening.  This only started happening 
>for the past 2 days.  We delete these devices and they come right back.  Email 
>me directly if you have any questions:  frank.kany@burr-reid.org
>
> This is what the devices look like:
> ================================================  Device                  
>Type        Text
>  QPADEV000B   V100        Device created for S1029348.
> QPADEV000C   V100        Device created for S1029348.
> QPADEV000D  V100        Device created for S1029348.
> QPADEV000F   V100        Device created for S1029348.
> QPADEV0001   V100        Device created for S1029348.
> QPADEV0002   V100        Device created for S1029348.
> QPADEV0003   V100        Device created for S1029348.
> QPADEV0004   V100        Device created for S1029348.
>
> We don't even have a user named "quit"
> ================================================
> Message ID . . . . . . :   CPF1397
> Date sent  . . . . . . :   04/02/02      Time sent  . . . . . . :   09:34:03
>
> Message . . . . :   Subsystem QINTER varied off work station QPADEV000D for
>   user QUIT.
>
> Cause . . . . . :   The maximum number of sign on attempts specified by system
>   value QMAXSIGN has been reached.  The device has been varied off for
>   security reasons.
> Recovery  . . . :   After checking with your security officer, vary the device
>   on using the Vary Configuration (VRYCFG) command.
>
> Hope this information helps.
> =================================================                          
>Display Device Description
>
> Device description . . . . . . . . :   QPADEV000D
> Option . . . . . . . . . . . . . . :   *BASIC
> Category of device . . . . . . . . :   *DSP
>
> Device class . . . . . . . . . . . :   *VRT
> Device type  . . . . . . . . . . . :   V100
> Device model . . . . . . . . . . . :   *ASCII
> Emulated twinaxial device  . . . . :   3196A2
> Online at IPL  . . . . . . . . . . :   *NO
> Attached controller  . . . . . . . :   QPACTL01
> --
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.