Now, user enumeration is not something you hear a lot about in the IBM i world yet by default it is possible on any IBM i Server and to be blunt, it’s easier to do on IBM i than on many other platforms. The good news is it’s easy to address on virtually any version of IBM i. Put simply, user enumeration is when a malicious actor uses a brute-force technique to either guess or confirm valid users in a system. I’m going to spend the next few paragraphs showing some examples of the issue, if you just want to get to the solution, you will be forgiven to skipping down to the section titled “How do you prevent this sort of user enumeration?” How do can you enumerate users? Once you know these, you can start to work on working out what the passwords might be. If you type in a user name that you know exists and get the password wrong you get a message at the bottom of the screen:ĬPF1107 – Password not correct for user profile The easiest way to demonstrate User Enumeration is at the IBM i Sign On Screen. If you type in a user name that does not exist, you get a message at the bottom of the screen: #Ibm i access client solutions change default user password# So, if you repeat this process given enough time you can put together a list of valid users, this is User Enumeration.

As mentioned earlier, once you know a user, you can then start working on hacking the password. Now, at this point many of you will say “Hang on a minute” I disable user profiles that have too many invalid login attempts and disable user profiles if someone does this. Sorry, that doesn’t help that much as if you try to signon with a user that has been disabled you still get a message like:ĬPF1394 User profile ROWTON cannot sign on.

So, yes disabling user profiles does slow these attacks, especially if you have to keep reconnecting sessions but it does not stop it. The problem is not limited to the 5250 Sign On screen, another common example is the Initial ACS Signon to IBM i, where you get a message like CPIAD06 – Invalid sign on attempt made. How do you prevent this sort of user enumeration? The answer is as simple as changing the messages you get when you fail to sign on. #Ibm i access client solutions change default user password#įortunately, that is as simple as issuing a CHGMSGD change message description command for each message that could be used to enumerate.

Rdn generic rp