How could a 3rd party remote support user un a process from their PC that would change several system values and submit several jobs?
I'm think some sort of run remote command.
From QHST
Message ID . . . . . . : CPIAD09
Date sent . . . . . . : 12/13/17 Time sent . . . . . . : 08:45:17
Message . . . . : User CVGVALTE from client 198.49.86.86 connected to job
586434/QUSER/QZDASOINIT in subsystem QUSRWRK in QSYS on 12/13/17 08:45:17.
From the QAUDJRN, I know it was done by the below job and user.
Journal . . . . . . : QAUDJRN Library . . . . . . : QSYS
Sequence . . . . . . : 132992229
Code . . . . . . . . : T - Audit trail entry
Type . . . . . . . . : SV - Change to system value
Object . . . . . . . :
Type . . . . . . . :
Date . . . . . . . . : 12/13/17
Time . . . . . . . . : 08:45:28
Flag . . . . . . . . : 0
Count/RRN . . . . . : 0
Commit cycle ID . . : 0
Nested commit level : 0
Job . . . . . . . . : 587349/QUSER/QZRCSRVS
User profile . . . . : CVGVALTE
Ignore APY/RMV . . . : No
Ref constraint . . . : No
Created havoc on our LPAR for a bit.
I got all system values changed back to original, except for QAUDLVL , still need to find those original settings.
1) If this was run with remote command, how can we lock this down, except for certain users?
Thank You
_____
Paul Steinmetz
IBM i Systems Administrator
Pencor Services, Inc.
462 Delaware Ave
Palmerton Pa 18071
610-826-9117 work
610-826-9188 fax
610-349-0913 cell
610-377-6012 home
psteinmetz@xxxxxxxxxx
http://www.pencor.com/
midrange.com
