× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Looks nice. Unfortunately we are at V5R1 and it works at V5R2 and
subsequent. Probably couldn't even restore the save file here to take a
look at the code, if available.

Thanks.

Jerry C. Adams
IBM i Programmer/Analyst
Politeness is the end of passion. -Bill Veeck
--
A&K Wholesale
Murfreesboro, TN
615-867-5070


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Helge Bichel
Sent: Tuesday, October 25, 2011 11:53 AM
To: 'Midrange Systems Technical Discussion'
Subject: RE: Slew of FTP Jobs

Have a look at SECTCP on http://www.easy400.net/sectcp/start

Brgds
Helge


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Monnier, Gary
Sent: Tuesday, October 25, 2011 6:30 PM
To: Midrange Systems Technical Discussion
Subject: RE: Slew of FTP Jobs

Hi Jerry,

Ending *FTP will end all QTFTPxxxxx jobs (at least a V5R4 it does). Do
you have exit programs on the QIBM_QTMF_CLIENT_REQ, QIBM_QTMF_SERVER_REQ
and QIBM_QTMF_SVR_LOGON exit points? If you do and are logging events
can you tell who signed through FTP or what IP address submitted the
request? If not, you may want to think about putting some in place so
you can track who and from where your FTP server is being accessed.


The QIBM_QTMF_CLIENT_REQ exit point is fired when the AS/400 (i5, system
I, i6 or your choice) FTP client is used.

The QIBM_QTMF_SVR_LOGON exit point fires when someone signs on through
FTP - local client or external.

The QIBM_QTMF_SERVER_REQ exit point fires when the FTP server is
accessed.

Gary

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jerry C. Adams
Sent: Tuesday, October 25, 2011 8:19 AM
To: Midrange-L
Subject: Slew of FTP Jobs

I have a slew of FTP jobs that started for the most part on Wednesday
(19
October) at about 0300, I copied the WRKACTJOB panels below with the
date each was submitted to the right and, where applicable, other clones
that it submitted listed under it.



We do not have anything in the job scheduler set to run at 0300.



I, also, included a typical joblog after that.



First, what are all of these FTP jobs? They look like port scans to me,
but I am no expert.



Second, will ENDTCPSVR *FTP end them?





Subsystem/Job User Type CPU % Function Status

QTFTP01402 QTCP BCH .0 DEQW
5-30-11
10:06

Submits 18318 10-19-11 3:03

Submits 18550 same

Submits 18614 same

Submits 18781 same

Submits 18843 same

Submits 19008 same

Submits 19070 same

QTFTP01413 QTCP BCH .0 DEQW 5-31-11
06:52

Submits 18085 10-19-11 3:03

Submits 18151 same

Submits 18305 same

Submits 18457 same

QTFTP01471 QTCP BCH .0 DEQW
5-30-11
10:06

Submits 23070 10-19-11 3:03

Submits 23136 same

Submits 23381 same

QTFTP01546 QTCP BCH .0 DEQW
10-19-11
03:04

QTFTP01640 QTCP BCH .0 DEQW
10-19-11
03:04

QTFTP01681 QTCP BCH .0 DEQW
10-19-11
03:04

QTFTP04276 QTCP BCH .0 DEQW 5-30-11
10:05

QTFTP12625 QTCP BCH .0 DEQW 7-07-11
08:31

Submits 57811 10-19-11 3:03

Submits 57876 same

Submits 58032 same

Submits 58116 same

Submits 58275 same

QTFTP14748 QTCP BCH .0 DEQW 10-19-11
3:03

Submits 01681 10-19-11 3:04

QTFTP14818 QTCP BCH .0 DEQW
10-19-11
3:03

QTFTP14890 QTCP BCH .0 DEQW
10-19-11
3:03

QTFTP15130 QTCP BCH .0 DEQW
10-19-11
3:03

QTFTP18085 QTCP BCH .0 DEQW

QTFTP18151 QTCP BCH .0 DEQW

QTFTP18305 QTCP BCH .0 DEQW

QTFTP18318 QTCP BCH .0 DEQW

QTFTP18457 QTCP BCH .0 DEQW

QTFTP18550 QTCP BCH .0 DEQW

QTFTP18614 QTCP BCH .0 DEQW

QTFTP18781 QTCP BCH .0 DEQW

QTFTP18843 QTCP BCH .0 DEQW

QTFTP19008 QTCP BCH .0 DEQW

QTFTP19070 QTCP BCH .0 DEQW

QTFTP23070 QTCP BCH .0 DEQW

QTFTP23136 QTCP BCH .0 DEQW

QTFTP23381 QTCP BCH .0 DEQW

QTFTP57811 QTCP BCH .0 DEQW

QTFTP57876 QTCP BCH .0 DEQW

QTFTP58032 QTCP BCH .0 DEQW

QTFTP58116 QTCP BCH .0 DEQW

QTFTP58275 QTCP BCH .0 DEQW

QTFTP79240 QTCP BCH .0 DEQW
8-13-11
8:20

Submits 14748 10-19-11 3:03

Submits 14818 same

Submits 14890 same

Submits 15130 same



Part of a typical joblog:



Job 037119/QTCP/QTFTP01546 started on 10/19/11 at 03:04:18 in subsystem

QSYSWRK in QSYS. Job entered system on 10/19/11 at 03:04:18.

Job 037119/QTCP/QTFTP01546 submitted.

0 DDM conversations ended, 0 remain active.

Object changed for QTEMP in QSYS type *LIB.

SSL socket operation received return code -93. [TCP3D2C]

FTP problem when using the QsyCheckUserFunctionUsage API. [TCP3D08]

SSL socket operation received return code -93.

SSL socket operation received return code -93.

FTP problem when using the QsyCheckUserFunctionUsage API.

SSL socket operation received return code -93.

FTP problem when using the QsyCheckUserFunctionUsage API.

SSL socket operation received return code -93.

FTP problem when using the QsyCheckUserFunctionUsage API.



Meaning: -93 SSL is not available for use.

The "0 DDM" and the next line do not usually show up.



Jerry C. Adams

IBM i Programmer/Analyst

What do you get when you cross a penguin with a schoolteacher? A formal
education.

--

A&K Wholesale

Murfreesboro, TN

615-867-5070



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.