Re: Finding IP address of Failed Login Attempt
[email protected] Thu, 3 May 2007 09:48:44 -0400
| Newsgroups | gmane.comp.systems.as400.security |
|---|---|
| Message-ID | <OF50065A86.CBCD8075-ON852572D0.00488753-852572D0.004BE5B8@spirax.com> |
> I also see a few PW audit records without any value for the Remote Address > field. Perhaps some of these other fields will help you determine what is > going on. The complete list of violation types can be found in Appendix F > of the Security Reference manual. Apparently nothing that hits port 636 has any details recorded. Why anything would be hitting the LDAP server, which isn't even running, is beyond me. I now have two two users showing up every two seconds for failed signon attempts--while their 5250 sessions are up, running and logged in! Neither of the two is configured to use Kerberos in Ops Navigator or the 5250 session. > Seq Field Text > 10 PWTSTP Timestamp of entry Yep, I can see the entries every two seconds. > 20 PWRADR Remote address Completely blank whenever the remote port is 636. > 30 PWTYPE P-Pwd, U-User name, A-APPC, D-DST user, E- Two Ps, followed by thousands of Qs, that all makes sense. >40 PWJOB Name of job QTVDEVICE, but its joblog has no further info..... > 50 PWUSER Name of user QTCP, no help there...... >60 PWNBR Number of job Used with PWJOB above to look at a non-useful joblog... > 70 PWPGM Name of program QCMD, no help there.... > 80 PWUSPF User profile QTCP, no help there.... > 90 PWRPORT Remote port All to port 636..... > 100 PWDEVN Device name Completely blank for port 636 entries..... I've gone field by field through the entire output of CPYAUDJRNE and nothing helps for the entires where the port=636. Everything is either blank or leads to a job log with no details. I guess we'll move the box with ETHEREAL to the switch with the iSeries. Traffic on port 636 should stand out like a sore thumb. _______________________________________________ This is the Security Administration on the AS400 / iSeries (Security400) mailing list To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected] To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/security400 or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected] Before posting, please take a moment to review the archives at http://archive.midrange.com/security400.