You can use an exit program on the AS/400 for FTP security if you are on V3R2 or V3R7 or later release of the OS. If you do not have the exit program you may need to apply PTFs for it. You can write your own FTP exit program or several commercial products are available. We have one that you can review http://www.patownsend.com You are correct that any user with a PC can access the AS/400 with FTP. And if they have a user profile already they can get an FTP session, access to database files, and a command line. It is a security risk that you should look at. The AS/400 offers some object security, but this is inadequate for most AS/400 users.

---

Check these exit points: QIBM_QTMF_CLIENT_REQ QIBM_QTMF_SERVER_REQ You can also check the manual: OS/400 TCP/IP Configuration and Reference for more information hth

---

I would change the objects authority to something like QPGMR *ALL *PUBLIC *EXCLUDE - and don't assign the group profile (In this example QPGMR) to the user. They will not have access to any object on the AS/400. The initial program they use when starting from a green screen will need to be owned by QPGMR (or whatever group profile you choose to use). That authority will be adopted by your programs running so there won't be any problems from an application perspective - but nobody can get access to data from FTP without explicitly giving them authority.

---

Check out WRKREGINF, and the exit program QIBM_QTMF_SVR_LOGON which will allow you to reject certain users, or even map the entered user to another user (with different securtiry).

---