Re: Best way to access QHST programatically

[qsrvbas@xxxxxxxxxxxx]

cobol400-l-request@xxxxxxxxxxxx wrote:

>   1. Re:  Best way to access QHST programatically
>      (MichaelQuigley)
>
> Are there any authority issues accessing the QHST* files?  I've never been 
> able to find any.  Perhaps it's the way our system administrator has 
> things configured.  (Developers aren't part of the QPGMR group, but rather 
> their own PGMMR group.)

Michael:

I'm not sure if you're asking from a policy or a technical viewpoint. I'm more 
of a technician, but I'll ask around on general issues. I won't be surprised if 
others add responses, though you might be better served on the Security400 list.

Two areas come to mind immediately:

First, it's possible to delete QHST* physical files. That means that various 
activities can be masked. Simple access doesn't pose that risk though.

Second, there's an awful lot of info that can be gained by scanning QHST*. 
Qualified job names and other bits can divulge many of the user profile names 
on your system for example. You might not have authority to see what user 
profiles exist through other means, but viewing QHST* can fill in gaps. 
Subsystem names, remote locations, schedules, all kinds of info can be gathered.

Never underestimate the power of information. When combined with other info, 
your general network and much of the environment can be deduced fairly 
accurately.

Tom Liotta