RE: auditor access

<snip>
they did a guess at service accounts, matched one, and hit it enough to
disable it..
</snip>

People who set
QMAXSGNACN
Action to take for failed signon attempts
to either 2 or 3
1=Disable device
2=Disable profile
3=Disable device and profile

Easily set their system up for a denial of service attack.

Granted, any putz user cannot get a list of your users, but they CAN get a
list of their message queues.
WRKOBJ OBJ(QUSRSYS/*ALL) OBJTYPE(*MSGQ)
or
SELECT objname
FROM TABLE(QSYS2.OBJECT_STATISTICS('QUSRSYS', '*MSGQ')) AS a;
Having the user set to limited capabilities (aka no command line) won't do
a darn thing to stop them from accessing that sql statement (or any number
of similar methods) available to a client/server app.

And then it's a simple matter of trying to sign on more than the value in
QMAXSIGN
Maximum sign-on attempts allowed

And it's easily automated as shown by your external probe.

One thing to consider is having your messaging software re-enable those
profiles after x minutes.

Rob Berendt