Re: Security Exit point monitoring

[John Earl <john.earl@xxxxxxxxxxxxxx>]

Thanks Charles - I had not seen these before.  They remind me a bit of  
the old WSG exits.

They would require application modification in order to work, and they  
could also be easily spoofed by an application that wanted to pose as  
your application.  Still, if your application did monitor for these  
values it would keep out generic Excel and Word ODBC calls, and that  
is some value.

jte


On May 27, 2010, at 5:56 AM, Charles Wilt wrote:

> On Thu, May 27, 2010 at 6:08 AM, John Earl  
> <john.earl@xxxxxxxxxxxxxx> wrote:
> > If I understand your question correctly, then the answer is,
> > unfortunately, no.  There is no way for the IBM i side Exit Program  
> > to
> > know anything about which client side program initiated a remote SQL
> > access attempt.  The i side just knows that it received a remote SQL
> > request, it can see the SQL string along with some basic identifying
> > information about he job on the i (User name, etc.).  The i side exit
> > program can also find other information on the i about the job such  
> > as
> > IP address, group profile membership, LMTCPB status, etc, but there  
> > is
> > nothing in the data string passed that would identify any information
> > about the client side program that launched the request in the first
> > place.
>
> Actually, that's not quite true anymore...
>
> With 6.1, IBM added some special registers,:
> CURRENT CLIENT_ACCTNG
> CURRENT CLIENT_APPLNAME
> CURRENT CLIENT_PROGRAMID
> CURRENT CLIENT_USERID
> CURRENT CLIENT_WRKSTNNAME
>
>
> Granted you have to modify your client applications to pass the values
> along, but you could do so then restrict the activities allowed by
> connections, such as those from Excel, that have blanks for the
> current values.
>
> Charles
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L)  
> mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.

--
John Earl
President and CEO
Patrick Townsend Security Solutions
"The Encryption Company"

Olympia, WA | www.patownsend.com
Office: 360-357-8971 Ext 118