RE: AS400 Automatic Sending of New Password?

["Chris Bipes" <chris.bipes@xxxxxxxxxxxxxxx>]

Ok please don't shoot me.  You can write a simple program to monitor the
QSYSMSG message queue.  This will use the retrieve message API.  When
you retrieve the message for a disabled user ID you can evoke a program
to reset the user ID.  I have a simple command/CLP call RESETUSER that
enables operators to reset passwords on all but *SECOFR/*SECADM
profiles.  The CLP runs under *OWNER and is owned by QSECOFR.  It does
not log who performed the reset.  I am working on a RPG version to
record who changes whom for auditing purposes.  I have restricted the
use of the command/program via an *AUTL.  I also have a CLP that reads
the message queue.  Contact me if you want a copy of the source..  Chris
dot Bipes at Cross-Check dot com

 

Chris Bipes
Director of Information Services
CrossCheck, Inc.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of fbocch2595@xxxxxxx
Sent: Thursday, June 18, 2009 4:54 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: AS400 Automatic Sending of New Password?

Hi Folks, my head is spinning w/all these repsonses that are greatly
appreciated.??
?
I'm trying to complete this task without any rpg programming and?I'm not
sure that'll be possible.

Thanks and keep the responses coming,

Frank? 







-----Original Message-----
From: John Earl <johntearl@xxxxxxxxxxxxx>
To: Midrange-List <midrange-l@xxxxxxxxxxxx>
Sent: Wed, Jun 17, 2009 6:31 pm
Subject: Re: AS400 Automatic Sending of New Password?



Zactly!

jte 
Sent via BlackBerry from T-Mobile

-----Original Message-----
From: "Walden H. Leverich" <WaldenL@xxxxxxxxxxxxxxx>

Date: Wed, 17 Jun 2009 17:12:14 
To: Midrange Systems Technical Discussion<midrange-l@xxxxxxxxxxxx>
Subject: RE: AS400 Automatic Sending of New Password?


> If you can encrypt a password on SYSA and store it and use it on SYSB 
> (and you can) then the last 32 passwords would not be a requirement.

And that's the basis of the dictionary attack. IIRC, the same password
will always encrypt (likely a hash) to the same value. It has to if I
can move the encrypted values between machines. Therefore I build a nice
table of plaintext to encrypted/hashed passwords and read it backwards. 

-Walden