Re: Devices created automatically

["Jim Franz" <franz400@xxxxxxxxxxxx>]

>Consider changing your  telnet server to only accept the 5250 emulation
type.

how?

jim

----- Original Message -----
From: "Fritz Hayes" <fhayes@spiritone.com>
To: <midrange-l@midrange.com>
Sent: Tuesday, April 02, 2002 12:32 PM
Subject: RE: Devices created automatically


> Also, these look to be VT100 sessions!  This is the type of telnet that
> comes native with any desktop machine today.  Consider changing your
> telnet server to only accept the 5250 emulation type.
>
> Best Regards
>
> Fritz Hayes
> Atwater Associates
> <snip>
> |
> | If you already came to the conclusion, that it might be a hacking
> problem,
> | you should react now:
> | - take down the FTP server, if you don't need it at this moment, it's
> easy
> | to
> | "quote" remote commands through it ...
> | - tell your users not to sign off form their PC's, watch their
> connections
> | and
> | delete everything else which was created under the QPACTL01
> controller.
> | - turn off QAUTOVRT
> | - block the incoming ip-connection at your firewall / packetfilter
> level.
> |
> | HTH, Philipp Rusch
> |
> | "Frank W. Kany IV" schrieb:
> |
> | > This is a multi-part message in MIME format.
> | > --
> | > [ Picked text/plain from multipart/alternative ]
> | > Devices are being created automatically every 5 to 10 minutes on our
> | AS/400 (V4R3).  We have no idea how this is happening.  This only
> started
> | happening for the past 2 days.  We delete these devices and they come
> | right back.  Email me directly if you have any questions:
> | frank.kany@burr-reid.org
> | >
> | > This is what the devices look like:
> | > ================================================  Device
> | Type        Text
> | >  QPADEV000B   V100        Device created for S1029348.
> | > QPADEV000C   V100        Device created for S1029348.
> | > QPADEV000D  V100        Device created for S1029348.
> | > QPADEV000F   V100        Device created for S1029348.
> | > QPADEV0001   V100        Device created for S1029348.
> | > QPADEV0002   V100        Device created for S1029348.
> | > QPADEV0003   V100        Device created for S1029348.
> | > QPADEV0004   V100        Device created for S1029348.
> | >
> | > We don't even have a user named "quit"
> | > ================================================
> | > Message ID . . . . . . :   CPF1397
> | > Date sent  . . . . . . :   04/02/02      Time sent  . . . . . . :
> | 09:34:03
> | >
> | > Message . . . . :   Subsystem QINTER varied off work station
> QPADEV000D
> | for
> | >   user QUIT.
> | >
> | > Cause . . . . . :   The maximum number of sign on attempts specified
> by
> | system
> | >   value QMAXSIGN has been reached.  The device has been varied off
> for
> | >   security reasons.
> | > Recovery  . . . :   After checking with your security officer, vary
> the
> | device
> | >   on using the Vary Configuration (VRYCFG) command.
> | >
> | > Hope this information helps.
> | > =================================================
> | Display Device Description
> | >
> | > Device description . . . . . . . . :   QPADEV000D
> | > Option . . . . . . . . . . . . . . :   *BASIC
> | > Category of device . . . . . . . . :   *DSP
> | >
> | > Device class . . . . . . . . . . . :   *VRT
> | > Device type  . . . . . . . . . . . :   V100
> | > Device model . . . . . . . . . . . :   *ASCII
> | > Emulated twinaxial device  . . . . :   3196A2
> | > Online at IPL  . . . . . . . . . . :   *NO
> | > Attached controller  . . . . . . . :   QPACTL01
> | > --
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>