Have a look at SECTCP on
http://www.easy400.net/sectcp/start
Brgds
Helge
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Monnier, Gary
Sent: Tuesday, October 25, 2011 6:30 PM
To: Midrange Systems Technical Discussion
Subject: RE: Slew of FTP Jobs
Hi Jerry,
Ending *FTP will end all QTFTPxxxxx jobs (at least a V5R4 it does). Do
you have exit programs on the QIBM_QTMF_CLIENT_REQ, QIBM_QTMF_SERVER_REQ
and QIBM_QTMF_SVR_LOGON exit points? If you do and are logging events
can you tell who signed through FTP or what IP address submitted the
request? If not, you may want to think about putting some in place so
you can track who and from where your FTP server is being accessed.
The QIBM_QTMF_CLIENT_REQ exit point is fired when the AS/400 (i5, system
I, i6 or your choice) FTP client is used.
The QIBM_QTMF_SVR_LOGON exit point fires when someone signs on through
FTP - local client or external.
The QIBM_QTMF_SERVER_REQ exit point fires when the FTP server is
accessed.
Gary
-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jerry C. Adams
Sent: Tuesday, October 25, 2011 8:19 AM
To: Midrange-L
Subject: Slew of FTP Jobs
I have a slew of FTP jobs that started for the most part on Wednesday
(19
October) at about 0300, I copied the WRKACTJOB panels below with the
date each was submitted to the right and, where applicable, other clones
that it submitted listed under it.
We do not have anything in the job scheduler set to run at 0300.
I, also, included a typical joblog after that.
First, what are all of these FTP jobs? They look like port scans to me,
but I am no expert.
Second, will ENDTCPSVR *FTP end them?
Subsystem/Job User Type CPU % Function Status
QTFTP01402 QTCP BCH .0 DEQW
5-30-11
10:06
Submits 18318 10-19-11 3:03
Submits 18550 same
Submits 18614 same
Submits 18781 same
Submits 18843 same
Submits 19008 same
Submits 19070 same
QTFTP01413 QTCP BCH .0 DEQW 5-31-11
06:52
Submits 18085 10-19-11 3:03
Submits 18151 same
Submits 18305 same
Submits 18457 same
QTFTP01471 QTCP BCH .0 DEQW
5-30-11
10:06
Submits 23070 10-19-11 3:03
Submits 23136 same
Submits 23381 same
QTFTP01546 QTCP BCH .0 DEQW
10-19-11
03:04
QTFTP01640 QTCP BCH .0 DEQW
10-19-11
03:04
QTFTP01681 QTCP BCH .0 DEQW
10-19-11
03:04
QTFTP04276 QTCP BCH .0 DEQW 5-30-11
10:05
QTFTP12625 QTCP BCH .0 DEQW 7-07-11
08:31
Submits 57811 10-19-11 3:03
Submits 57876 same
Submits 58032 same
Submits 58116 same
Submits 58275 same
QTFTP14748 QTCP BCH .0 DEQW 10-19-11
3:03
Submits 01681 10-19-11 3:04
QTFTP14818 QTCP BCH .0 DEQW
10-19-11
3:03
QTFTP14890 QTCP BCH .0 DEQW
10-19-11
3:03
QTFTP15130 QTCP BCH .0 DEQW
10-19-11
3:03
QTFTP18085 QTCP BCH .0 DEQW
QTFTP18151 QTCP BCH .0 DEQW
QTFTP18305 QTCP BCH .0 DEQW
QTFTP18318 QTCP BCH .0 DEQW
QTFTP18457 QTCP BCH .0 DEQW
QTFTP18550 QTCP BCH .0 DEQW
QTFTP18614 QTCP BCH .0 DEQW
QTFTP18781 QTCP BCH .0 DEQW
QTFTP18843 QTCP BCH .0 DEQW
QTFTP19008 QTCP BCH .0 DEQW
QTFTP19070 QTCP BCH .0 DEQW
QTFTP23070 QTCP BCH .0 DEQW
QTFTP23136 QTCP BCH .0 DEQW
QTFTP23381 QTCP BCH .0 DEQW
QTFTP57811 QTCP BCH .0 DEQW
QTFTP57876 QTCP BCH .0 DEQW
QTFTP58032 QTCP BCH .0 DEQW
QTFTP58116 QTCP BCH .0 DEQW
QTFTP58275 QTCP BCH .0 DEQW
QTFTP79240 QTCP BCH .0 DEQW
8-13-11
8:20
Submits 14748 10-19-11 3:03
Submits 14818 same
Submits 14890 same
Submits 15130 same
Part of a typical joblog:
Job 037119/QTCP/QTFTP01546 started on 10/19/11 at 03:04:18 in subsystem
QSYSWRK in QSYS. Job entered system on 10/19/11 at 03:04:18.
Job 037119/QTCP/QTFTP01546 submitted.
0 DDM conversations ended, 0 remain active.
Object changed for QTEMP in QSYS type *LIB.
SSL socket operation received return code -93. [TCP3D2C]
FTP problem when using the QsyCheckUserFunctionUsage API. [TCP3D08]
SSL socket operation received return code -93.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
Meaning: -93 SSL is not available for use.
The "0 DDM" and the next line do not usually show up.
Jerry C. Adams
IBM i Programmer/Analyst
What do you get when you cross a penguin with a schoolteacher? A formal
education.
--
A&K Wholesale
Murfreesboro, TN
615-867-5070
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
midrange.com
