Re: User HELLO?

Rob -

Do you actually have a User ID named 'HELLO' ?

When I had my AS/400 exposed to the internet, I saw lots of telnet logon attempts for user names like 'CISCO' which eventually caused the device to be varied off after the maximum # of sign on attempts.

- sjl



Rob wrote in message news:mailman.1601.1325596715.2619.midrange-l@xxxxxxxxxxxx...

DSPMSG QSYSMSG
CPF1397-Subsystem QINTER varied off work station QPADEV0002 for user
HELLO.
Date sent . . . . . . : 01/02/12 Time sent . . . . . . : 03:05:45

DSPJRN JRN(QAUDJRN) RCVRNG(*CURCHAIN) FROMTIME(010212 030545)
Lots of entries from jobs QYPSJSVR and QZOSIGN
Then
Sequence Code Type Object Library Job Time
6736807 T PW QINTER 3:05:45
Entry specific data
*...+....1....+....2.
UHELLO QPADEV0002

Sequence . . . . . . : 6736807
Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : PW - Invalid password or user ID

Remote port . . . . : 35289
System name . . . . : GDISYS
Arm number . . . . . : 16
Logical unit of work : *OMITTED
Transaction ID . . . : *OMITTED

DSPDEVD QPADEV0002
Device class . . . . . . . . . . . : *VRT
Device type . . . . . . . . . . . : V100
Device model . . . . . . . . . . . : *ASCII
Emulated twinaxial device . . . . : 3196A2
Online at IPL . . . . . . . . . . : *NO
Attached controller . . . . . . . : QPACTL01
Keyboard language type . . . . . . : USB
Print device . . . . . . . . . . . : *SYSVAL
Output queue . . . . . . . . . . . : *DEV
Printer file . . . . . . . . . . . : QSYSPRT
Library . . . . . . . . . . . . : *LIBL
Dependent location name . . . . . : *NONE
Allocated to:
Job name . . . . . . . . . . . . . : QCMNARB02
User . . . . . . . . . . . . . . : QSYS
Number . . . . . . . . . . . . . : 301800
Current message queue . . . . . . : QSYSOPR
Library . . . . . . . . . . . . : QSYS
Last activity date . . . . . . . . : 01/02/12
Text . . . . . . . . . . . . . . . : Device created for GDISYS.
NOTE: No IP address.

How do I hunt this down further?



Rob Berendt