Security Incident with Spool Files

[LiQuiD_FuSioN]

Someone's output queue got cleared out by a user apparently. Thanks to dspjrn/QAUDJRN I was able to output spool file data to a helpful QASYSFJ5-type outfile. I saw all the entries labeled as 'D' for a delete, and what IP it came from, user profile, etc. It was pretty darn neat.

Firstly, I'm just trying to wrap my head around how the user did it.

The job name is NOT from a typical workstation ID/device description, but it's coming from a "QZRCSRVS" job running under QUSER according to the log generated. I was thinking they deleted the files using System i Navigator because the user did say their i Nav froze up while "clearing" out old stuff apparently.

I did try recreating this by deleting a spool file from a test outq. When I ran dspjrn to excitedly see what happened I noticed the job name was different - showing up in log as "QNPSERVS" under QUSER.

- From what I gather "QZRCSRVS" is for remote commands. Could the user tried a remote command? User profile itself has limited capability with locked down menu.
- Am I chasing after nothing, and this is simply System i Nav doing its thing?
- I did try a dsplog and seeing when this "QZRCSRVS" came onto the system, I do see job getting started by the user and nothing else interesting
- I did try looking at QAUDJRN for any specific commands entered, and the job did not show up, so I can't tell what commands were launched - if any

Other than that, I think I've hit a rock wall with digging deeper into this little incident. Part of me thinks it was just System i Nav, other part of me thinks another process took over and made it look like the poor fellow did something wrong, who knows. Thanks for reading!

[tomliotta]

Re: Security Incident with Spool Files

With iNav, you can work with spooled files. However, from there, you can also drill down again to work with the *OUTQ. And from there, you can run a CLROUTQ command. I haven't looked, but there are probably other paths to effect the same result.

When working with spooled files, most operations will be done through a QNPSERVS (Network print server) job. But when working with an *OUTQ object, operations will run through a QZRCSRVS (Remote command server) job.

That's probably about all there is to what you're seeing. I'd think of it something like that many *OUTQs might not be handled through "Network print" functions. They might not be associated with any printer at all; and if they are, they might not be 'network' printers. (The same can be said about spooled files, but that doesn't help remind me of any difference.)

[EmmanuelW1]

Re: Security Incident with Spool Files

Possibly the user bumped into wrksplf.exe?

Cheers,

Emmanuel

[LiQuiD_FuSioN]

Re: Security Incident with Spool Files

With iNav, you can work with spooled files. However, from there, you can also drill down again to work with the *OUTQ. And from there, you can run a CLROUTQ command. I haven't looked, but there are probably other paths to effect the same result.

When working with spooled files, most operations will be done through a QNPSERVS (Network print server) job. But when working with an *OUTQ object, operations will run through a QZRCSRVS (Remote command server) job.

That's probably about all there is to what you're seeing. I'd think of it something like that many *OUTQs might not be handled through "Network print" functions. They might not be associated with any printer at all; and if they are, they might not be 'network' printers. (The same can be said about spooled files, but that doesn't help remind me of any difference.)

Thank you for the insight! I did not think there was an option like that to clear from the iNav GUI.

I went ahead and recreated the scenario, and sure enough, I saw the QZRCSRVS job tied to my outq.

To clear from iNav:
Right-click on outq -> Clear... -> 'Confirm Clear' box shows with name of Output Queue, library name, files, etc with big button to click 'Clear'

You would think the user would have noticed that they're in the wrong outq, but, that's how it goes sometimes. Learned something though!

[EmmanuelW1]

Re: Security Incident with Spool Files

Using the wrksplf.exe utility that's part of IBM i Access for Windows, a DLTSPLF entry with job QZRCSRVS is generated in the audit journal when a spool file is deleted.

Cheers,

Emmanuel