Re: Is message id TCP12AF a security risk?

[Bryan Dietz <bdietz400@xxxxxxxxx>]

DSPMSGD RANGE(TCP1222) MSGF(QTCP/QTCPMSGF)

need an "F" for the message file

Bryan

Dan Bale wrote on 1/9/2024 9:19 AM:
> select *
> FROM QSYS2.MESSAGE_FILE_DATA
> where Message_File_Library = 'QTCPMSG';
>
> ^ returned no rows.  Hmmm.
>
> Not a fan of message text = &1.  I was going to suggest just changing the message text for TCP12AF to "Hello" or somesuch, but with &1, who knows what else IBM uses it for?
>
> - Dan
>
> -----Original Message-----
> From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Rob Berendt
> Sent: Tuesday, January 9, 2024 8:31 AM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
> Subject: Is message id TCP12AF a security risk?
>
> Originally I was thinking that the subject line was the issue.  But now I'm not so sure.  Let me back up...
> When I ftp from one IBM i to another, after I log in I get:
> OS/400 is the remote operating system. The TCP/IP version is "V7R5M0".
> If you hit help on that you will see that the message id is TCP12AF.
> However, I do not get this message when I ftp from my pc dos client.
> Why is this a concern?  Well if nefarious people know the OS you are running on, and the version, they may be able to focus their attack vector more.
> One thing nice is that IBM obfuscates TCP12AF and uses the name of an OS that has long been obsoleted.
> Actually if you do DSPMSGD RANGE(TCP12AF) MSGF(QTCPMSG) you will see that the whole content of the message is data returned to it by the remote server.
>
> Thus the question really becomes:  how do I stop my IBM i from supplying the OS name and it's version?
>
> I tried querying every message file on the system to see if that is where this is stored by running this:
> select *
> FROM QSYS2.MESSAGE_FILE_DATA
> where MESSAGE_TEXT LIKE '%OS/400%' AND MESSAGE_TEXT LIKE '%V7R5M0%';
>
> But it didn't find any hits.
>
> There may be legal reasons why you do not want to publish the version of the OS.  NDA possibly.
>
> *** CONFIDENTIALITY NOTICE: The information contained in this communication may be confidential, and is intended only for the use of the recipients named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this communication, or any of its contents, is strictly prohibited. If you have received this communication in error, please return it to the sender immediately and delete the original message and any copy of it from your computer system. If you have any questions concerning this message, please contact the sender. ***