I believe we identified how this occurred, waiting for their official followup.
The remote 3rd party support user accidently ran a script (.bat) file that was either on their PC or on a shared drive.
The script was used to set up an LPAR for one of their remotes.
They were confused on which remote they were connected to.
The script probably contained rmtcmd.
CWBLOGON x.x.x.x /u user /p password
rmtcmd CHGSYSVAL SYSVAL(QFRCCVNRST) VALUE(3)
etc (17 of these)
rmtcmd SBMJOB CMD(CALL PGM(SETUP)) JOB(SETUP)
etc (15 of these)
CWBLOGON x.x.x.x /u user /C
1) How can we lock down rmtcmd for restricted internal use only?
We do have a few internal processes that use this.
Paul
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Steinmetz, Paul
Sent: Wednesday, December 13, 2017 4:22 PM
To: 'Midrange Systems Technical Discussion'
Subject: How could a 3rd party remote support user run a process from their PC that would change several system values and submit several jobs?
How could a 3rd party remote support user un a process from their PC that would change several system values and submit several jobs?
I'm think some sort of run remote command.
From QHST
Message ID . . . . . . : CPIAD09
Date sent . . . . . . : 12/13/17 Time sent . . . . . . : 08:45:17
Message . . . . : User CVGVALTE from client 198.49.86.86 connected to job
586434/QUSER/QZDASOINIT in subsystem QUSRWRK in QSYS on 12/13/17 08:45:17.
From the QAUDJRN, I know it was done by the below job and user.
Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS
Sequence . . . . . . : 132992229
Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : SV - Change to system value
Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 12/13/17
Time . . . . . . . . : 08:45:28
Flag . . . . . . . . : 0
Count/RRN . . . . . : 0
Commit cycle ID . . : 0
Nested commit level : 0
Job . . . . . . . . : 587349/QUSER/QZRCSRVS
User profile . . . . : CVGVALTE
Ignore APY/RMV . . . : No
Ref constraint . . . : No
Created havoc on our LPAR for a bit.
I got all system values changed back to original, except for QAUDLVL , still need to find those original settings.
1) If this was run with remote command, how can we lock this down, except for certain users?
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx
http://www.pencor.com/
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
http://amzn.to/2dEadiD
midrange.com
