Re: Limiting FTP sessions

[rob@xxxxxxxxx]

Well, I suppose that, if the user profile is locked then I could issue an 
immediate endjob for that other user.

But, then I could also look at it this way, how often would multiple ftp 
sessions be caught at the same time?  It's not like 5250 in which you 
leave a session running for any great length of time.  Thus if they are 
sharing profiles, then they'd really have to be cranking out the sessions 
to get two going at the same time.  With the checks on:
limiting what ftp operations are allowed,
limiting which directories they can upload to and which they can download 
from,
limiting how much space may be used by their user profile,
Should I really spend anymore development dollars, or blood pressure on 
this issue?

As far as a pmr goes IBM reached their limits and now want an InsultLine 
contract at $270/hour, 1 hour minimum and 6 minute increments.

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 




rob@xxxxxxxxx
Sent by: midrange-l-bounces@xxxxxxxxxxxx
03/28/2003 04:33 PM
Please respond to Midrange Systems Technical Discussion
 
        To:     Midrange Systems Technical Discussion 
<midrange-l@xxxxxxxxxxxx>
        cc: 
        Fax to: 
        Subject:        Limiting FTP sessions


Y'all know that the
Limit device sessions  . . . . . LMTDEVSSN
part of a user profile is ignored for ftp sessions, right?  Ok with that 
background I thought I'd get clever on my exit points and when someone 
logs on if they already have another ftp session running then it would not 

allow them to start a second.  I do this by checking for object locks on 
the user profile.  Worked great if someone ftp'ed from a dos command 
prompt or from a 5250 command session.  However if they used a browser 
then they couldn't start any sessions.

This is what I figured out what was happening.  Lovely (dripping with 
sarcasm) MSIE would:
I)  Request exit point is called under QTCP with a request code of 0 for 
log on.  I allow that.  Job=043731/QTCP/QTFTP02845.
II)  Login exit point is called under ANONYMOUS which I forbid. 
Job=043731/QTCP/QTFTP02845. 
III)  Request exit point is again called under QTCP with a request code of 

0 for log on.  I allow that.  Job=043732/QTCP/QTFTP00078.
IV)  Login exit point is again called under ANONYMOUS which I again 
forbid.  Job=043732/QTCP/QTFTP00078. 
IV-A)  Browser user is prompted for User id and password 
V)  Request exit point is again called under QTCP with a request code of 0 

for log on.  I allow that.  Job=043733/QTCP/QTFTP00081.
VI)  Login exit point is called with 'dummy' user id.  I allow that by 
giving it a return code of 3 which allows logon but overrides user 
profile.  Rest of it looks fine.    Job=043733/QTCP/QTFTP00081.
VII)  Requst exit point is (strangely) called again under QTCP with a 
request code of 0 for log on.  I allow that.  Job=043734/QTCP/QTFTP00079.
VIII)  Login exit point is called with 'dummy' user id.  However, I stop 
it because the user profile I've overridden to is assigned to another ftp 
job (043733/QTCP/QFTTP00081).
VIII-A)  Browser user is again prompted for their user id.

The MSIE browser does the double whammy with steps V/VI & VII/VIII.  I 
modified my program to stop checking for locks on the user profile in 
order to pay homage to the MSIE gods.  However now the problem becomes is 
there anyway to stop a browser user from having more than one session?  I 
believe the answer is no.  What do you think?


Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.