Re: Calling a program without knowing the parms

Hi Jim,

How about adding some security checking on the RPG sockets program, i.e.
before allowing just anyone to utilize its callpgm facility, check a userid
& password?  Of course, then you'd have to get into secure sockets, but what
the heck, John wants to learn something new, right?

Regards,
Peter Dow
Dow Software Services, Inc.
909 425-0194 voice
909 425-0196 fax

From: "Jim Langston" <jimlangston@conexfreight.com>
> I think I see what you are trying to do.  You want a generic TCP/IP
> program on the AS/400 that will listen to requests on a certain port,
> then accept the request, get the program name to run and the parameters,
> run the program, and pass the return parameters back to the socket.

> snip <

> Oh, cool, your AS/400 has this socket program to run programs and accept
> parameters.  I'll just right a real quick socket program on a PC and have
> it run the API to change my authority, or create a new user profile with
> *ALLOBJ, or open up the FTP port so I can FTP in, or have it dump the
> QSYSOPR user profile so I can brute force the password or...  You just
> blew security wide open.


> +---
> | This is the RPG/400 Mailing List!
> | To submit a new message, send your mail to RPG400-L@midrange.com.
> | To subscribe to this list send email to RPG400-L-SUB@midrange.com.
> | To unsubscribe from this list send email to RPG400-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

+---
| This is the RPG/400 Mailing List!
| To submit a new message, send your mail to RPG400-L@midrange.com.
| To subscribe to this list send email to RPG400-L-SUB@midrange.com.
| To unsubscribe from this list send email to RPG400-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---