|
> -----Original Message----- > From: dhandy@isgroup.net [mailto:dhandy@isgroup.net] > > Dave, > > >The LOGINP exposure was "public" knowledge on the /38 back > in the '80's - > > I was still stuck on the S/36 then. :( I do remember reading a Q38 > article (by Ken Kelly?) on how to view the clear-text passwords in > QSYUPTBL, but at the time I did not work on the S/38... I didn't see > the article until I was on V1R1 of OS/400. (Which is also the last > time I read it, so I'm not 100% positive on the author.) > > >Even today, I'll bet > >the answer is likely to be something like "secure your > subsystems so that > >the display files can't be changed illegitimately". > > I think this is a legitimate answer. I don't consider this a "bug". > But neither do I recall ever being told to guard against it, or verify > before promoting to production that it wasn't added by a rogue > programmer. Maybe I just haven't paid enough attention over the years > and this was common knowledge. Wouldn't be the first time. <g> Well, I said "public" - I never said "common" (or even "COMMON" - grin). You're right, I don't believe I've ever seen any mention of it in anything from IBM. And I have to admit that I've never exactly gone out of my way to mention it to people, nor have I ever seen it mentioned by others in public. I guess it just seemed so obvious - or maybe I subconsciously didn't want to cause a lot of concussions from all the head slapping. <g> At the time he showed it to me, John said that with security settings as-shipped on the /38, there wasn't a way for anyone without *ALLOBJ to view QSECOFR's joblog, even on an outq, since the outq's were all secured. The problem was that no one ever left the security on the outq's, so the joblogs became exposed. The addition of the *SPLCTL special authority on the /400 made the exposure greater, of course, since that authority is so over-used by so many shops. I don't remember, on a new install what are the authorizations on QEZJOBLOG? Has anyone ever seen this in any of the third-party books on security, like the ones by Wayne Evans and Wayne Madden? I don't happen to have any of them accessible at the moment. Or is there a mention in any of the IBM books, white or red? Dave Shaw Spartan International, Inc. Spartanburg, SC +--- | This is the MI Programmers Mailing List! | To submit a new message, send your mail to MI400@midrange.com. | To subscribe to this list send email to MI400-SUB@midrange.com. | To unsubscribe from this list send email to MI400-UNSUB@midrange.com. | Questions should be directed to the list owner/operator: dr2@cssas400.com +---
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.