RE: Enable Disabled Users and Devices

Sorry... that won't work either.

My exit point prohibits ODBC Logon for all users except those in a list.

Care to try again?

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob Berendt
Sent: Tuesday, November 2, 2021 10:59 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: RE: Enable Disabled Users and Devices

I think it's great to disable user profiles upon bad signon's.
Users can't generate a list of users? True. But they can generate a list of user message queues. They have to be able to. If they don't have access to the message queues then they can't send them a message.
So you generate a list of message queues like this
WRKOBJ OBJ(QUSRSYS/*ALL) OBJTYPE(*MSGQ)
Oh? You secured them from the command line? Simple to work around. They can download any number of tools to do this:

select objname
from table(OBJECT_STATISTICS('QUSRSYS', '*MSGQ')) x;

Then you just try signing on each one of those until they are disabled.
Soon, you've disabled every user on the system.
Great denial of service attack.

Rob Berendt