Subject: Re: Userid/password for 5250 Telnet printer

From: Jeffrey Stevens <[email-masked]>
Date: Thu, 16 Apr 1998 14:19:40 -0400

Hi Barry,

For printer sessions, it is not necessary to send down the USER,
IBMRSEED and IBMSUBPW variables.  If they are sent, then they are
ignored. Sound insecure?  Not really, because creating display devices
works the same way. You can create display devices without a profile
and password (e.g. you get a sign-on panel with the device name in the
upper right corner), but you cannot actually use the display device
(e.g. sign-on to the system) without a profile and password.

Similarly, in order to spool files to a new printer device, a user
needs access to the device, which requires a profile and password.
So, you can create the printer, but without a profile/password you cannot
print anything to it.

It so happens that QTCP user profile is granted *ALL authority to the
printer (and by extension, to displays as well) because that is the profile
under which Telnet runs when the device is created.  I believe the
PUBLIC authority is dependent on the *LIBCRTAUT value for QSYS on the system
(which is usually dependent on the QCRTAUT system value).

On a related issue, the QAUTOVRT system value allows the System
Administrator to set a value of 0 to stop auto-creation of new devices
(like printers and displays).  Thus, you can be completely blocked from
creating printers if the administrator wants to block you.

==================================================================
Jeffrey Stevens/Endicott/IBM - AS/400 TCP/IP Applications (LPD/WSG/Telnet)
Work: [email-masked]     Private: [email-masked]
"There is no such thing in anyone's life as an unimportant day." - Alexander
Woollcott

[email-masked] on 04/08/98 05:48:07 PM
Please respond to [email-masked]
To: [email-masked]
cc:
Subject: Userid/pwd for 5250 telnet printer

     Ref: RFC 1205, part 8. Enhanced Printer Emulation Support

     I would be grateful to get some clarification on userid/password
     options in printer sessions for 5250 telnet.

     Should a printer client send USER, IBMRSEED and IBMSUBSPW values?
     Pick one:   Always ___   Never ___   Sometimes ___

     I'm a bit confused whether these are needed or even desirable for
     printer sessions.  Part 8 doesn't mention them and its printer
     examples don't show them.  I tried sending them to a v4r2 machine and
     they seem to be ignored; even an invalid USER value results in a
     successful connection.  I'm beginning to think a printer client should
     never send them.

     Please forgive my ignorance, but how _does_ the AS/400 provide
     security for its printed output?  I had assumed a user could set the
     object authority on a printer device description to prevent others
     from using it.  But this doesn't seem to be the case; the tn5250e
     printer LUD is owned by QTCP which allows anyone to connect to it.  So
     what prevents anyone with a TCP stack from acquiring a printer device
     and then printing possibly sensitive data?  If this is already covered
     somewhere, then kindly give me a pointer to it, thanks.

     Barry Hansen
     [email-masked]