Re: Is someone trying to hack my system?

SSL is all well and good if all you ever intend is for a rare telnet 5250
session for at home support. Basically you'd configure your firewall to
only allow the telnet port in and only to your iSeries. And if you only
need it from home, (and not the flexibility of any net cafe) and you have
a static ip address at home then your firewall can be further set up to
only allow certain IP addresses to come in that way.
However I find that my at home support often requires access to the
company email, some shared file servers, access to internal only web based
applications (like hmc). Maybe throw in the ability to use DameWare to
take control of a coworkers PC screen, Sametime instant messaging, etc.
And to do all that I find requires VPN, or Virtual Private Networking,
access. We use Cisco here.

We used to restrict ftp to certain IP addresses coming in. However it got
to be a real pain to talk to business partners about NAT or Network
Address Translation. Often delayed ftp implementation a week or more.
Also some needed the ability to ftp on the road. Our network guy
practically wanted it in writing to open up ftp to all incoming addresses.
Occasionally I will block some particularly bothersome IP addresses.
They're not getting in, I just get tired of seeing them in the log.

Rob Berendt