Re: Invalid signon attempts

Have you reviewed your QHST history log to see if there is a pattern to
when these invalid signon attempts are occurring? It's not difficult to
write a program to read the history logs and print an exception report.


Steven Morrison
Fidelity Express
903-885-1283 ext. 479



"Shannon ODonnell" <sodonnell@xxxxxxxxxxxxxxxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
08/03/2007 09:23 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
cc

Subject
Invalid signon attempts






I have a bunch of user profiles on a client system that have 100's of
invalid signon attempts attached to them. These are not the standard IBM
Q*
profiles either, but rather normal profiles like BOBA, or TWIECK or
whatever.



Normally I might think that someone is physically standing there trying to
get onto the system when I see an invalid signon attempt. But in this
case,
this AS/400 is on a VPN and I wouldn't think that the outside world could
be
trying some brute force attacks like this.



So this makes me wonder if it really is someone on the network who either
knows these old profile names or is trying to guess them.



But some of them have like 900+ invalid attempts to log on.



It is slightly possible that a former vendor, who was kicked out of this
location, may be responsible for trying to get past these disabled
profiles,
but there are just soooo many attempts it seems incredible that these
could
be done manually.



Can you think of any other ways/reasons for so many invalid logon
attempts?



Thanks,



Shannon O'Donnell