If a user has authority to log in over TCP/IP using FTP, how can I determine when they have logged in after the event? And even better, how can I see what they have done?
It is possible to set FTP exit programs to do exactly what you are asking for. This can be done by the following:
- Writing your own program. This program will be called for FTP activity and you will be able to monitor and even control the requests.
- Buy solutions for monitoring security events for remote connections to iSeries (including FTP ODBC and remote command access). All these tools can monitor and log requests.
For FTP we have two exit programs:
- FTP server logon will be called upon logon to the server.
- Request validation exit program will be called for every specific request in the FTP session.
The following describes a simple exit program you can tailor to your own needs. For example, you may decide to send every request to FTP to message queue).
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/rzaiq/rzaiqexamplogoncl.htm
This was first published in March 2008