Re: Preventing user profile lockout

[Mike.Crump@xxxxxxxxxxxxxxxx]

Stu,

One way to do it is to use exit points and not allow the account to be
accessed from FTP, TELNET, etc.  It's a bit different approach than you
might have wanted but it is an effective way to control that type of DOS or
similar action.  That way the user access is stopped even before it get's
to the validation process.  Something I would recommend to people for their
IBM supplied accounts as well........


Michael Crump
Manager, Computing Services
Saint-Gobain Containers
1509 S. Macedonia Ave.
Muncie, IN  47302
(765)741-7696
(765)741-7012 f
(800)428-8642

"The probability that we may fail in the struggle ought not to deter us
from the support of a cause we believe to be just"  Abraham Lincoln






                                                                           
             "Bramley, Stu"                                                
             <stu.bramley@skan                                             
             dia.co.uk>                                                 To 
                                       Midrange Systems Technical          
             03/21/2005 11:27          Discussion                          
             AM                        <midrange-l@xxxxxxxxxxxx>           
                                                                        cc 
                                                                           
             Please respond to                                     Subject 
             Midrange Systems          Preventing user profile lockout     
                 Technical                                                 
                Discussion                                                 
             <midrange-l@midra                                             
                 nge.com>                                                  
                                                                           
                                                                           



I have a requirement to prevent certain service/connection accounts from
being locked out - for example due to password validation errors. This
is to prevent the profiles being deliberately locked out as part of a
denial of service attack.

We do not want to set QMAXSIGN to *NOMAX as this applies at a system,
rather than an individual profile level.

Does anyone know of a way to do this? Is there an exit point we can hook
into when a user profile is disabled and use this either to stop the
profile from being disabled or re-enable the profile? Is there a way to
override this system value at an individual user profile level?

Regards,
Stu

Stuart Bramley
Senior Technical Developer
Skandia Life::GroupIT
Southampton
t: 023 80 72 64 29 e: stu.bramley@xxxxxxxxxxxxx
IBM Certified Specialist
Sun Certified Java Programmer
If you are not the intended recipient, please notify the sender by return
email and then delete the message from your computer. The Skandia UK Group
reserves the right to monitor e-mail communications through its networks.

No contract may be concluded on behalf of the Skandia UK Group by email.

Skandia Life Assurance (Holdings) Limited Skandia Life Assurance Company
Limited Skandia MultiFUNDS Limited, Skandia Investment Management Limited.

Registered Nos: 1606702, 1363932, 1680071, 4227837, England
Registered Office: Skandia House, Portland Terrace, Southampton SO14
7EJ, United Kingdom

Royal Skandia Life Assurance Limited Registered No : 24916 Isle of Man
Registered Office: Skandia House, King Edward Road, Onchan, Isle of Man
IM99 1NU, British Isles

Skandia Life Assurance Company Limited, Skandia MultiFUNDS Limited, Skandia
Investment Management Limited and Royal Skandia Life Assurance Limited are
authorised and regulated by the Financial Services Authority for UK
investment business.

Internet: www.skandia.co.uk



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.