Re: Disabled profile

Thanks Gad,

No this profile is used every day.

We have ascertained the profile was disabled for incorrect password
attempts coming in the ssh port that we opened for sftp transfers nightly.

We are now locking down the source addresses that can access that port.

Not perfect but better than open to all.

Cheers

Don




From: "Gad Miron" <gadmiron@xxxxxxxxx>
To: midrange-l@xxxxxxxxxxxxxxxxxx
Date: 23/01/2023 07:43 PM
Subject: Re: Disabled profile
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>



Just a thought,

Was the user profile inactive for a long time?
There is a feature of the service agent I think that
disables USRPRFs after X days of inactivity.

Gad

date: Mon, 23 Jan 2023 08:43:41 +1000
from: Don Brown via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
subject: Disabled profile

I am trying to investigate how a profile became disabled.

This is a 7.3 system and the audit journal does not include *SECURITY

In the history log I can see the profile became disabled at 00:16:58 on
Saturday morning.

Thee were no log entries for invalid password (CPF2234).

There is noting related in the system operator message queue.

This is the first time this has happened.

The profile that was disabled is only used for database access from a
Linux system running PHP and accessing the IBMi database

The system is using the iACS ODBC driver to connect. Would there be logs
on the Linux box ?

Any suggestions appreciated.

Thanks

Don




--
This email has been scanned for computer viruses. Although MSD has taken
reasonable precautions to ensure no viruses are present in this email,

MSD

cannot accept responsibility for any loss or damage arising from the use

of

this email or attachments..


------------------------------

End of MIDRANGE-L Digest, Vol 22, Issue 45
******************************************