RE: What is causing a user profile to be disabled?

You hacker!! :)

Thanks,
Gary Monnier
IT Software Engineer CSM, CSPO


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of rob@xxxxxxxxx
Sent: Friday, July 24, 2015 10:12 AM
To: Midrange Systems Technical Discussion
Subject: Re: What is causing a user profile to be disabled?

Was there an IP address in the audit journal?
F10=Display only entry details
...
Job . . . . . . . . : 710475/QTCP/QTFTP00065
...
Remote address . . . : 10.10.8.237

NSLOOKUP HOSTNAME('10.10.8.237')
237.8.10.10.in-addr.arpa name = gdl164.dekko-1.

Hey, GDL164 is my laptop! :-)


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: Glenn Gundermann <glenn.gundermann@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 07/24/2015 01:01 PM
Subject: Re: What is causing a user profile to be disabled?
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Thanks Gary, this was very useful.
This confirms it is happening from an FTP job.

From job . . . . . . . . . . . : QTFTP00026

User . . . . . . . . . . . . : QTCP

Number . . . . . . . . . . . : 673856


I fouind three jobs that ran 5 minutes apart and each one had an invalid
password. The third job disabled the user profile.


How can I find who/what is submitting these jobs?

A WRKJOB on any of these jobs tells me nothing.


Thanks again for all assistance.



Yours truly,

Glenn Gundermann
Email: glenn.gundermann@xxxxxxxxx
Work: (416) 675-9200 ext. 89224
Cell: (416) 317-3144


On 24 July 2015 at 12:03, Monnier, Gary <Gary.Monnier@xxxxxxxxx> wrote:

Have you checked QAUDJRN for password failure entries? Use journal code

T

entry type PW. Position 1 in the entry specific data shows the

violation

type and starting in position 2 is the user profile job user where the
failure occurred. You can find the complete layout in appendix F of the
security reference manual.

Types of failures are...

A APPC bind failure.
C User authentication with the CHKPWD command failed.
D Service tools user ID name not valid.
E Service tools user ID password not valid.
P Password not valid.
Q Attempted signon (user authentication) failed because user profile is
disabled.
R Attempted signon (user authentication) failed because password was
expired.
This audit record might not occur for some user authentication
mechanisms.
Some authentication mechanisms do not check for expired passwords.
S SQL Decryption password is not valid.
U User name not valid.
X Service tools user ID is disabled.
Y Service tools user ID not valid.
Z Service tools user ID password not valid

Gary Monnier

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Glenn Gundermann
Sent: Friday, July 24, 2015 7:59 AM
To: Midrange Systems Technical Discussion
Subject: What is causing a user profile to be disabled?

Hi folks,

Is there a way to find out what is causing a user profile to be

disabled?

I suspect it's an FTP process from another server that is causing this.

When I press Help on CPF1393 in QHST, there is very little information.
device *N
network address *N
subsystem QSYSWRK

This is happening several times each day. What's funny is that nobody

is

complaining about a process not working but obviously if they have the
wrong password something has got to be failing.

Any guidence would be appreciated.

Yours truly,

Glenn Gundermann
Email: glenn.gundermann@xxxxxxxxx
Work: (416) 675-9200 ext. 89224
Cell: (416) 317-3144
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.