Re: Finding IP address of Failed Login Attempt

I got them under v5r4
CPYAUDJRNE ENTTYP(PW) FROMTIME('05/01/07')


 File: QAUDITPW    Outfile for journal entry type PW
brary: QTEMP       Format: QASYPWJ5   Nbr. Records:          26
ember: QAUDITPW      Type: PF         Size (Bytes):         24,576

                                                                   User 
Remote Remote
   Type Timestamp                                  profile        port 
address
   PW   2007-05-01-16.44.33.746224 QUSER       4565  10.0.1.53
   PW   2007-05-01-20.50.05.043776 QUSER       2447  10.0.1.80
   PW   2007-05-02-08.03.48.842544 QUSER       1874  10.0.1.74
   PW   2007-05-02-08.28.49.421760 QUSER       4870  10.0.1.53
   PW   2007-05-02-08.30.10.892416 QUSER       2867  10.0.1.83
   PW   2007-05-02-10.50.14.907968 QUSER       1029  10.0.1.53
   PW   2007-05-02-10.50.58.758832 QUSER       1040  10.0.1.53
   PW   2007-05-02-11.43.57.639328 QUSER       1095  10.0.1.53
   PW   2007-05-02-11.45.16.679552 QUSER       1105  10.0.1.53
   PW   2007-05-02-11.50.49.117136 QUSER       1090  10.0.1.71
   PW   2007-05-02-14.03.32.502448 QUSER       1621  10.0.1.53
jim

----- Original Message ----- 
From: "Turnidge, Dave" <DTurnidge-jXHaHu7tDRvNHyFk3Yt2uVaTQe2KTcn/@public.gmane.org>
To: "Security Administration on the AS400 / iSeries" 
<security400-Zwy7GipZuJhWk0Htik3J/[email protected]>
Sent: Wednesday, May 02, 2007 1:46 PM
Subject: Re: [Security400] Finding IP address of Failed Login Attempt


>I did the 5.3 instructions, and DO get IP addresses...
>
> -----Original Message-----
> From: security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]
> [mailto:security400-bounces-Zwy7GipZuJhWk0Htik3J/[email protected]] On Behalf Of [email protected]
> Sent: Wednesday, May 02, 2007 12:45 PM
> To: security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> Subject: Re: [Security400] Finding IP address of Failed Login Attempt
>
>> If your system is at V5R4 you should use the new CPYAUDJRNE command
> instead
>> of DSPAUDJRNE. Once the file has been created use your favorite query
>> to select and print the fields you are interested in. The IP address
>> from where the request originated should be in the header section of
>> each
> *TYPE5
>> audit record.
>
> Much like the screen capture, CPYAUDJRNE gives me a lot of blank fields,
> but no IP address.  Remote port shows 636, remote address is blank.
> Device name, local name, network name, object name and library name are
> all blank.  The various reserved columns are blank.
>
>> If you are on an earlier release you should first use CRTDUPOBJ
>> OBJ(QASYPWJ5) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(QTEMP) to create a
>> physical file in QTEMP and then use DSPJRN with OUTFILFMT(*TYPE5) to
> copy
>> the PW audit records to that file. The remaining steps to display the
> data
>> will be the same as for V5R4.
>
> We are on V5R4, as current on CUMEs as one can get.  I assume that
> CPYAUDJRNE displays with *TYPE5--there doesn't seem to be an option to
> control that.
>
> For kicks, I followed the steps as though we were on a prior release,
> and I can see plenty of IP addresses under other types of entries.  PW
> entries do not have this information.
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400)
> mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To
> subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a
> moment to review the archives at
> http://archive.midrange.com/security400.
>
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400) 
> mailing list
> To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/security400
> or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/security400.
> 


_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.