Re: Send Files from PC to AS/400 based on an event

Bill,

In one of his COMMON sessions called "How an AS/400 is hacked" Trevor Seeney
outlines a simple method of using the DBXREF files to identify all of the
FTP scripts (it is amazingly simple) that are stored on a /400, and then use
a simple source scan to harvest the passwords out of them.

So, if you're in the habit of storing passwords in text files (an ugly
necessity sometimes), one hopes that you're all in the habit of securing
that source file from prying eyes.  One also assumes you are eagerly
awaiting FTP support for kerboros in some future release after V5R2.  When
that comes you will no longer need to store passwords in text files.

jte


--
John Earl
www.powertechgroup.com  john.earl@powertechgroup.com
The Powertech Group Inc. Seattle, Washington
Where the Security Experts Live!

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--
----- Original Message -----
From: "Bill Meecham" <bmeecham@weichertrealtors.net>
To: <midrange-l@midrange.com>
Sent: Tuesday, May 28, 2002 12:12 PM
Subject: Re: Send Files from PC to AS/400 based on an event


> Kathie,
>
> Here's how I do PC to AS400:
>
> in a .bat file -
>
> ftp -n -s:ftpio.txt
>
> in the text file, in this case 'ftpio.txt', that is in the same
"folder/directory"
>
> open 192.46.255.15
> user as400userName
> as400password
> bin
> put host447h16.svf /qsys.lib/wmtest.lib/host447h16.file/host447h16.mbr
> bye
> rem get /qsys.lib/qgpl.lib/f0116x.file/f0116x.mbr c:\f0166x.txt
> rem put c:\ascquery2.txt /qsys.lib/xmtest.lib/asc.file/asc.mbr
> rem put c:\sig182p001 /qsys.lib/xmtest.lib/sig182p001.file/sig182p001.mbr
> rem get /qsys.lib/xmtest.lib/mysavf.file/mysavf.mbr c:mysavf.savF
>
>
> Explanation:
> the .bat file will cause ftp to use the text file as input
>
> open as400 ip address
> user name
> password
> ftp optional settings
> ftp command (actual work)
> exit ftp (bye)
> rem = commented items for easy copy to the actual work line
>
>
> to run:  on pc click start, run, command (or cmd), use driveLetter: & cd..
to point to correct directory and run the .bat file by typing its name.
>
>
>
> Bill
>
>
> ----- Original Message -----
> From: "Jim Langston" <jlangston@celsinc.com>
> To: <midrange-l@midrange.com>
> Sent: Tuesday, May 28, 2002 2:50 PM
> Subject: RE: Send Files from PC to AS/400 based on an event
>
>
> > Kathie,
> >
> > There are a few ways to do it, depending on how deep you want to go, and
if
> > you want to write PC or AS/400 programs.  The easiest, IMO, would be to
> > write a simple .BAT batch file on the PC that would upload any files in
the
> > directory to the AS/400.  Should be simple to do, simple batch file.
> >
> > Then, on the AS/400, write a CL program that does a RUNRMTCMD on the PC
to
> > call this batch file and then wait for 5 minutes, then RUNRMTCMD again
in an
> > endless loop.  Add this CL to the job scheduler WRKJOBSCDE to start at
like
> > midnight every day, or whenever your system is available in the morning.
> >
> > So, now when new files are available they will be FTPed up to the
AS/400.
> >
> > The biggest problem with this is FTPing a file to the AS/400 that is
still
> > being written.  The way I handled this is I had the program that created
the
> > files create an empty file called upload.now and when the batch file saw
> > this file it would FTP up the files.
> >
> > HTH,
> >
> > Regards,
> >
> > Jim Langston
> >
> > From: "Heeter, Kathleen" <KHeeter@bphsc.com>
> >
> > Good Afternoon;
> >
> > We are implementing a new software package on our branch pc's.
> > This software will create text files of orders to be sent to the as/400.
One
> > file will be created per order. Pxxxmmddyyhhmmss is the naming
convention of
> > each individual file. We need to come up with the best way to
automatically
> > get these files to the 400 without user (salesperson) intervention. We
need
> > to confirm to them that we received the file. We need to provide a way
for
> > them to resend the files to us at corporate if they were not received
> > properly. Is there some job I can create on the PC's to say if P*.*
shows up
> > in c:\directoryname, trigger job to send it to the 400? Then FTP the
file?
> > Is that the best way? If so, do you know of a way to show them we
received
> > the file....
> > So many questions..... Can you help? Please and thank-you tons!!!!
> >
> > Kathie
> > _______________________________________________
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> > To post a message email: MIDRANGE-L@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> > or email: MIDRANGE-L-request@midrange.com
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>