Re: AS400 Audit Checks

You could check out the checklist we use for AS 400 (attached). Another 
interesting finding we came up with, was to check all users who have 
Special Authorities (*SPCAUT), such as *ALLOBJ. We found about 5-6 users 
with SPCAUT, whose passwords were also default (ANDFTPWD). Now, the 
argument the client put forward was that these were service accounts, 
and when we tried to connect using Client Access, it gave us either no 
command-line access, or logged us out immediately. However, when we 
connected with those same accounts using FTP, we were able to download a 
large number of data files, and reveal critical information back to them.

Cheers,

KK

K. K. Mookhey
Founder & CTO
Network Intelligence (I) Pvt. Ltd.
Web: www.nii.co.in
------------------------------------
Comprehensive Security Assessment Software
http://www.nii.co.in/products.html
------------------------------------

This message may contain privileged and confidential information and is 
solely for the use of intended recipient. If you are not the intended 
recipient you should not disseminate, distribute, store, print, copy or 
deliver this message. Please notify the sender immediately by e-mail if 
you have received this e-mail by mistake and delete this e-mail from 
your system.


cruxiezzzzz@yahoo.com wrote:
> Hi,
>
> Anyone out there has any idea on how to audit or scan for AS400 based system? 
> Any tool recommendations or checklist would be greatly appreciated.
>
> thanks
> Mag

as400auditchklist.xls
Description: MS-Excel spreadsheet