Re: AS400 Audit Checks

You could check out the checklist we use for AS 400 (attached). Another
interesting finding we came up with, was to check all users who have
Special Authorities (*SPCAUT), such as *ALLOBJ. We found about 5-6 users
with SPCAUT, whose passwords were also default (ANDFTPWD). Now, the
argument the client put forward was that these were service accounts,
and when we tried to connect using Client Access, it gave us either no
command-line access, or logged us out immediately. However, when we
connected with those same accounts using FTP, we were able to download a
large number of data files, and reveal critical information back to them.

Cheers,

KK

K. K. Mookhey
Founder & CTO
Network Intelligence (I) Pvt. Ltd.
Web: www.nii.co.in
------------------------------------
Comprehensive Security Assessment Software
http://www.nii.co.in/products.html
------------------------------------

This message may contain privileged and confidential information and is
solely for the use of intended recipient. If you are not the intended
recipient you should not disseminate, distribute, store, print, copy or
deliver this message. Please notify the sender immediately by e-mail if
you have received this e-mail by mistake and delete this e-mail from
your system.


cruxiezzzzz@yahoo.com wrote:
> Hi,
>
> Anyone out there has any idea on how to audit or scan for AS400 based system? 
> Any tool recommendations or checklist would be greatly appreciated.
>
> thanks
> Mag

as400auditchklist.xls
Description: MS-Excel spreadsheet