QMAXSGNACN

Action when the number of sign-on attempts exceeds the maximum

PowerTech recommended setting: 2 = Disable Profile

Importance: High

Purpose: Determines what action is taken when the maximum invalid sign-on number is exceeded.

The options are:

Risks and Concerns: Disabling the device is ineffective in a TCP/IP Telnet environment because devices are assigned at connection.  Disabling devices may actually assist a hacker with a Denial of Service (DOS) attack.

The "Disable Device" setting could assist a DOS attack by knocking all of the devices off-line due to invalid password attempts. This would be much harder to do with profiles because each valid profile would have to be named in order to cause it to be disabled.

FTP sessions do not use a device description. If “Disable Device” is selected, there is no effect when multiple bad logons are attempted. Disabling the profile will prevent access regardless of the connection method.