RE: Slew of FTP Jobs

Chuck,

Thanks. Unfortunately the auditing level was set to *None (probably because
they were real low on disk space when I came on site). I changed it to
*AutFail in case it happens again.

The PTF cited in the link (SI15193) is not on our system. In fact, the
highest SI ptf I can find is SI01499! But I ordered it, anyway.

Jerry C. Adams
IBM i Programmer/Analyst
We don't have to worry about endangered species - why, we can't even get rid
of the cockroach. -James Watt, Secretary of the Interior under Reagan
--
A&K Wholesale
Murfreesboro, TN
615-867-5070


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of CRPence
Sent: Tuesday, October 25, 2011 12:19 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Slew of FTP Jobs

On 25-Oct-2011 08:19 , Jerry C. Adams wrote:

I have a slew of FTP jobs that started for the most part on Wednesday
(19 October) at about 0300, I copied the WRKACTJOB panels below with
the date each was submitted to the right and, where applicable, other
clones that it submitted listed under it.

We do not have anything in the job scheduler set to run at 0300.

I, also, included a typical joblog after that.

First, what are all of these FTP jobs? They look like port scans to
me, but I am no expert.

FTP server jobs, servicing client FTP requests, though some only or
also for starting new jobs to handle detected volume of incoming FTP
requests beyond what are already being serviced.

Second, will ENDTCPSVR *FTP end them?

Yes.

Job User Type CPU % Function Status
QTFTP01402 QTCP BCH .0 DEQW 5-30-11 10:06

<<SNIPped bunch of QTFTP##### jobs in list>>

Part of a typical joblog:

Job 037119/QTCP/QTFTP01546 started on 10/19/11 at 03:04:18 in subsystem
QSYSWRK in QSYS. Job entered system on 10/19/11 at 03:04:18.
Job 037119/QTCP/QTFTP01546 submitted.
0 DDM conversations ended, 0 remain active.
Object changed for QTEMP in QSYS type *LIB.
SSL socket operation received return code -93. [TCP3D2C]
FTP problem when using the QsyCheckUserFunctionUsage API. [TCP3D08]
SSL socket operation received return code -93.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.
SSL socket operation received return code -93.
FTP problem when using the QsyCheckUserFunctionUsage API.


Meaning: -93 SSL is not available for use.

The "0 DDM" and the next line do not usually show up.

I seem to recall the DDM conversations and QTEMP library change
messages are from the job "reuse" activity; to recycle the job without
an actual end would require ending any DDM activity from the work
performed in a prior established session. I tried to get the FTP
components to rid of the messing with QTEMP, moving any requirements
into WM processing, but had no luck; was still there in v5r4 IIRC. As
long as an actual FTP session is never established, the job can keep
rejecting requests... before eventually being recycled.

Auditing might help to see the user names which were rejected...
though possibly not on v5r1 without the appropriate PTF; oddly the APAR
was neither HIPer nor Security\Integrity flagged:
http://www-01.ibm.com/support/docview.wss?uid=nas233f451ed6055f6ed86256eb700
3cab05

Regards, Chuck