Re: 27,538 Sign-on attempts not valid

["Jim Franz" <franz400@xxxxxxxxxxxx>]

Have u got latest v4r5 CAE service pack sf 67276?
(never expect cae to run without a svc pack)
http://www-1.ibm.com/servers/eserver/iseries/access/sphist.htm

Do you have setup to auto logon? - remove that.

I have a vague recollection of having same problem, and updating
svc pack for either w2k or CAE, and removing any auto logon.
Is this w2k pro? with it's svc packs?
ssl connection?
jim


----- Original Message ----- 
From: "Al Barsa" <barsa@xxxxxxxxxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Friday, December 19, 2003 11:02 AM
Subject: Re: 27,538 Sign-on attempts not valid


>
>
>
>
>
> Hi,
>
> My two suspicions are:
>
> 1.    You have discovered some massive bug in OS/400, which has existed
> since CPF V1R2M0. ( *VERYUNLIKELY)
> 2.    Someone is programmatically trying to hack that user profile.
>
> Al
>
> Al Barsa, Jr.
> Barsa Consulting Group, LLC
>
> 400>390
>
> 914-251-1234
> 914-251-9406 fax
>
> http://www.barsaconsulting.com
> http://www.taatool.com
>
>
>
>
>              "Burns, Bryan"
>              <burnsbm@Echoinco
>              rporated.com>                                              To
>              Sent by:                  MIDRANGE-L@xxxxxxxxxxxx
>              midrange-l-bounce                                          cc
>              s@xxxxxxxxxxxx
>                                                                    Subject
>                                        27,538 Sign-on attempts not valid
>              12/19/2003 10:42
>              AM
>
>
>              Please respond to
>              Midrange Systems
>                  Technical
>                 Discussion
>              <midrange-l@midra
>                  nge.com>
>
>
>
>
>
>
> This morning user profile ELOYV showed a status of disabled and 27,538
> invalid sign-on attempts.  I changed the password for the profile
yesterday
> at 14:36:24 and QSYSWRK disabled the profile at 14:40:09.
>
> QAUDJRNE shows PW entries every two seconds from 14:40:00 yesterday to
> 7:10:17 this morning.  I enabled the profile at 07:19 this morning and
went
> over to the work station, a production floor PC.  The work station runs
> W2000 and CAE V4R5.  There was a window on the workstation indicating
ELOYV
> was disabled.  I entered the correct password and signed on.
>
> I originally thought there must have been a macro running but now I think
> it's a software bug.  Any thoughts on what caused all these sign-on
> attempts?
>
> Bryan Burns
> System Operator
> ECHO Incorporated
> Lake Zurich, Illinois
> 847-540-8400 ext. 493
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>