RE: Invalid signon attempts

I have had a similar thing happen to me. When I am connected from home
via VPN and the VPN connection drops...I re-connect and when I sign back
on to the System i it says X invalid sign-on attempts, X being the
number of sessions I had open when the VPN dropped. I haven't cared
enough to research it because the connection doesn't drop that often. I
guess I don't really have a point here other than to say I had a similar
thing....

~Zach
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Shannon ODonnell
Sent: Friday, August 03, 2007 9:24 AM
To: 'Midrange Systems Technical Discussion'
Subject: Invalid signon attempts

I have a bunch of user profiles on a client system that have 100's of
invalid signon attempts attached to them. These are not the standard IBM
Q*
profiles either, but rather normal profiles like BOBA, or TWIECK or
whatever.



Normally I might think that someone is physically standing there trying
to
get onto the system when I see an invalid signon attempt. But in this
case,
this AS/400 is on a VPN and I wouldn't think that the outside world
could be
trying some brute force attacks like this.



So this makes me wonder if it really is someone on the network who
either
knows these old profile names or is trying to guess them.



But some of them have like 900+ invalid attempts to log on.



It is slightly possible that a former vendor, who was kicked out of this
location, may be responsible for trying to get past these disabled
profiles,
but there are just soooo many attempts it seems incredible that these
could
be done manually.



Can you think of any other ways/reasons for so many invalid logon
attempts?



Thanks,



Shannon O'Donnell