On 01/05/2015 09:35 AM, Paul Gilmartin wrote:
On Mon, 5 Jan 2015 07:21:28 -0800, Charles Mills wrote:
For TSO, you can probe for known user ids, but you will see a lot of LOGON
and IEA989I message in the SYSLOG.
Only if you set a specific SLIP trap for this condition.
In the video cited:
] On Behalf
Of Joel Ewing
Sent: Monday, January 05, 2015 8:18 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
On 01/05/2015 09:35 AM, Paul Gilmartin wrote:
On Mon, 5 Jan 2015 07:21:28 -0800, Charles Mills wrote:
For TSO, you can probe for known user ids
@LISTSERV.UA.EDU
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
Back years ago I worked at a Top Secret shop. That product wrote a console
message when a log on attempt has occurred that specified an unknown user.
Sadly, what was usually seen was a password. It's been years since I
@LISTSERV.UA.EDU] On
Behalf Of Joel Ewing
Sent: Monday, January 05, 2015 8:18 AM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
On 01/05/2015 09:35 AM, Paul Gilmartin wrote:
On Mon, 5 Jan 2015 07:21:28 -0800, Charles Mills wrote:
For TSO, you can probe
I do not believe you will get RACF SMF and console messages for this type
of probing. It is my understanding that TSO performs a RACROUTE
REQUEST=EXTRACT to obtain the data to fill in the various fields in the
logon panel. When retrieving or replacing fields, the RACF manual
explicitly states:
@LISTSERV.UA.EDU] On Behalf
Of Frank Swarbrick
Sent: Monday, January 05, 2015 6:06 PM
To: IBM-MAIN@LISTSERV.UA.EDU
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
Something like this?ICH408I USER(MYPSWD99) GROUP() NAME(???
)
LOGON/JOB INITIATION - USER AT TERMINAL
On 5 January 2015 at 19:19, Tony's Basement Computer
tbabo...@comcast.net wrote:
Yep. BTW, how did Mr. Mainframehacker get to the TSO log on screen? Did
someone provide the magic VTAM command? I ask from ignorance because I
didn't watch 100% of the video and I'm not connect literate.
His
@LISTSERV.UA.EDU
Sent: Monday, January 5, 2015 9:57 AM
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
Back years ago I worked at a Top Secret shop. That product wrote a console
message when a log on attempt has occurred that specified an unknown user.
Sadly, what was usually seen
-MAIN@LISTSERV.UA.EDU
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
Something like this?ICH408I USER(MYPSWD99) GROUP() NAME(???
)
LOGON/JOB INITIATION - USER AT TERMINAL DVDU NOT RACF-DEFINED
The above was generated using the CICS CESN signon
IDs (was: CANCEL TSO Logon?)
On 5 January 2015 at 19:19, Tony's Basement Computer tbabo...@comcast.net
wrote:
Yep. BTW, how did Mr. Mainframehacker get to the TSO log on screen? Did
someone provide the magic VTAM command? I ask from ignorance because I
didn't watch 100% of the video and I'm
5, 2015 9:57 AM
Subject: Re: Enumerating User IDs (was: CANCEL TSO Logon?)
Back years ago I worked at a Top Secret shop. That product wrote a
console message when a log on attempt has occurred that specified an
unknown user. Sadly, what was usually seen was a password. It's been
years
11 matches
Mail list logo
