RE: FTP with server down

[Chris Bipes <chris.bipes@xxxxxxxxxxxxxxx>]

Alan,

Use the command NETSTST *CNN on your AS400 and see what is listening on port
21, the ftp port.  If your FTP server are truly ended, and staying ended.
If something is listening on this port, well someone has hacked your system.

Christopher K. Bipes      mailto:ChrisB@Cross-Check.com
Operations & Network Mgr  mailto:Chris_Bipes@Yahoo.com
CrossCheck, Inc.                  http://www.cross-check.com
6119 State Farm Drive     Phone: 707 586-0551 x 1102
Rohnert Park CA  94928    Fax: 707 586-1884

-----Original Message-----
From: alan shore [mailto:SHOREA@dime.com]
Sent: Friday, September 14, 2001 9:01 AM
To: midrange-l@midrange.com
Subject: RE: FTP with server down


Just to make sure I'm not going nuts (my wife and daughter would argue that
point) I just tried it again. Submitted the command ENDTCPSVR  SERVER(*FTP),
and verified that there was/were no FTP servers active. Tried to FTP from
MS-DOS. Lo and behold connection.
As I'm fairly new to FTP on the AS/400 I assumed this was normal. Because of
the replies on this particular thread, this needs to be investigated.
I will let you know of any discoveries.
Thanks all.

>>> "Dave George (400times)" <editor@400times.co.uk> 09/14/01 11:51AM >>>
Connection refused without the FTP server started on my v4r5 box.
Sure beats conventional wisdom!


-----Original Message-----
From: midrange-l-admin@midrange.com
[mailto:midrange-l-admin@midrange.com]On Behalf Of Steve McKay
Sent: 14 September 2001 16:39
To: midrange-l@midrange.com
Subject: Re: FTP with server down



"alan shore" <SHOREA@dime.com> wrote:

"Using the command (ENDTCPSVR  SERVER(*FTP)) to ensure that no FTP server
was
running, I was able to FTP from MS DOS to the AS/400 using my AS/400 user
 profile and password. If I am NOT authorized to our FTP authorization list
, I will be denied. (EXIT programs having been installed and implemented) .
 If I AM authorized to our FTP authorization list, I can proceed, with what
 I am authorized to do, with the regular AS/400 security AND whatever
security
has been applied via the exit programs."

If this is correct, then I would think that it would be a HUGE security
hole.  It is my understanding that, if the FTP server is not running, there
is nothing 'at the other end' to even present you with a user ID/password
challenge and you get a "Connection refused" message.  I am still unable to
cause the described behavior on my V4R5 system.  Is it possible that this
occurred via the Trivial FTP server?

Curious-er,

Steve

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.