midrange.com -- security400 mailing listMailing list archive for security400 at midrange.comRe: IBM i5OS Intrusion Detection System- May 31, 2008 Thanks for the response H. -----Original Message----- From: hsxxxxxxxxxxxxxxxx To: security400xxxxxxxxxxxx Sent: Fri, 30 May 2008 7:15 pm Subject: Re: Security400 IBM i5OS Intrusion Detection System Hi Frank, i started doing so while preparing some wo...http://feeds.midrange.com/~r/security400/~3/302055668/msg00011.html Re: IBM i5OS Intrusion Detection System- May 30, 2008 Hi Frank, i started doing so while preparing some workshops and analysing the traffic on our leased lines. In personal view i am not very pleased with the kind of installation and administration and ended up using a combination of junpier appliances and li...http://feeds.midrange.com/~r/security400/~3/301649310/msg00010.html IBM i5OS Intrusion Detection System- May 15, 2008 Hi all, has anyone followed this redbook and implemented on their i5 If so, how was it to install and implement and how did it work, etc. Thanks, Frankhttp://feeds.midrange.com/~r/security400/~3/291138297/msg00009.html Re: Wayne Evans' LOGCMD- May 6, 2008 Ed - Thanks for your help. If it's any consolation, the only folks with access to the program will be 5 programmers who, prior to my original implementation of this program, did have ALLOBJ all the time. My original program did not use journal entries but...http://feeds.midrange.com/~r/security400/~3/284829659/msg00008.html Re: Wayne Evans' LOGCMD- May 6, 2008 Ed Fishel wrote on 05062008 09:30:11 AM: reason Here is a version of the problem that reduces the risk of the job ending before the auditing attributes of the user profile are restored. Now the attributes are restored before the command line is displayed...http://feeds.midrange.com/~r/security400/~3/284829660/msg00007.html Re: Wayne Evans' LOGCMD- May 6, 2008 Steve McKay wrote on 05052008 03:44:54 PM: that without enforced. action That code is very close but not correct. Before I share code that does work on V6R1 (and probably other releases) I will first say that I do not like the idea of giving any user acc...http://feeds.midrange.com/~r/security400/~3/284700613/msg00006.html Re: Wayne Evans' LOGCMD- May 5, 2008 Ed - I've played with this most of the day and have come to the conclusion that you're correct - Wayne's trick of swapping to the same user profile without specifying CURRENT has probably been PTFed and no longer works. Here is the code in question: CALL ...http://feeds.midrange.com/~r/security400/~3/284183228/msg00005.html Re: Wayne Evans' LOGCMD- May 5, 2008 Steve, method of giving users (on-call programmers, actually) a way to respond to them ALLOBJ on their user profile We have a product that does this - with all the enhanced reporting and notification features you'd expect from a mature commercial product...http://feeds.midrange.com/~r/security400/~3/284155311/msg00004.html Re: Wayne Evans' LOGCMD- May 2, 2008 Steve MxKay wrote on 05022008 10:16:32 AM: to is The LOGCMD program would not be writing the CD audit records because the system will do that for you if auditing is turned on and if CMD auditing is specified for the user profile. I would not trust any a...http://feeds.midrange.com/~r/security400/~3/282195300/msg00003.html Re: Wayne Evans' LOGCMD- May 2, 2008 Ed - The program uses SNDJRNE to write a user-defined journal entry (type LC) to QAUDJRN, it does not write a "CD" audit record at all. Command auditing is turned on by (1) using the AUDLVL parm of RTVUSRPRF to get the current audit level (2) calling QSYSG...http://feeds.midrange.com/~r/security400/~3/282195301/msg00002.html |