Validate User Logon ---> OS/400 security issues

["Milt Habeck" <mhabeck@xxxxxxxxxx>]

Dear Chris,

The two notes you authored (attached below) introduce several
OS/400 vulnerability issues. OS/400 security is a very complicated
subject ... so ... the potential vulnerabilities are complicated too. Here
is a concise, written-in-plain-English summary of OS/400 vulnerabilities:
http://www.unbeatenpathintl.com/BOH-Benefits/source/1.html

Each OS/400 vulnerability is assessed by our new product,
Bill of Health Security Diagnostics and Rx for OS/400.
http://www.unbeatenpathintl.com/BOH/source/1.html

Bill of Health runs a fine tooth comb through OS/400 security
vulnerabilities and threats. The product then composes comprehensive
documentation about the risks that have been discovered and the potential
security implications of each discovery. Finally, Bill of Health prescribes
an approach to mitigate potential risks.

It would be a privilege to speak with you about the product.

Warm regards,

Milt Habeck
Unbeaten Path International
North America: (888) 874-8008
International: (262) 681-3151
European contact: (44) 1-737-824248
mhabeck@xxxxxxxxxx
www.unpath.com



++++++   +++++++   +++++++   +++++++   +++++++   +++++++
From: Chris Bipes
To: 'Midrange Systems Technical Discussion'
Sent: Tuesday, September 07, 2004 1:53 PM
Subject: +++++> RE: Validate User Logon


But I would have to do that at IPL cause production files are owned by these
profiles.  Really need to clean up this mess.  People used to create and own
their own crap.  Now these files are open and being updated by server
programs 24x7.  ARGHH!  Might need to script these users and just do it.
Tell me, how can I retrieve their distribution list membership?

Chris Bipes


++++++   +++++++   +++++++   +++++++   +++++++   +++++++
From: Chris Bipes
To: 'midrange-l'
Sent: Tuesday, September 07, 2004 11:57 AM
Subject: Validate User Logon


What APIs are available to validate a user profile for writing a custom
TCP/IP sockets application.  And do any of them have a restriction on
profiles created prior to V2R2?  Yes we have upgraded our systems from a B40
Running V1R1M3 to a 820 running V5R2.  Some of our profiles have been
migrated thru the years.  I have a new package that validates user logon and
fails with profiles created prior to V2R2.  These profiles own production
files that are open and in use 24x7.  I do not know what API the package
uses at this time.  They are looking at the problem from their end but
probably will not have an old profile to test with.  I would like to
research these APIs and see if it is a documented restriction or if there is
a work around.

Christopher K. Bipes
Manager of Systems Administration
CrossCheck, Inc.