Re[2]: Fwd: Emergency access

[John Swartzendruber <johnbs@xxxxxxxxxxxxxx>]

Maybe they just add the "firecall" supplemental group for a short, specific time
period.  I believe I would also like to do a little more auditing of the user
during that time.

____________________Reply Separator____________________
Subject:    Re: Fwd: Emergency access
Author: John Earl
Date:       4/25/97 9:49 AM

At 08:02 PM 4/24/97 -0700, you wrote:
>DAsmussen@aol.com wrote:
>> 
>> Hey Folks,
><snip>> 
>> In a message dated 97-04-23 16:50:35 EDT, robert.lilley@smtpgwy.springs.com
>> (Robert Lilley) writes:
>> 
>> >      Looking for opinions on how developers/programmers at other shops
>> >       obtain emergency security access to AS/400 objects that they
>> otherwise
>> >       do not have access to (assuming you're not one of those shops that
>> >       gives little thought to security).
>> >
>> >       On our mainframe, we have a pool of "firecall" IDs that have
>> >       more-than-usual access, essentially the equivalent of *ALLOBJ.  These
>> 
>> >       IDs stay in a suspended (e.g. *DISABLED) status and must be checked
>> >       out for temporary use (typically they are enabled only for one day at
>> 

>Consider "FireCall" Group Profiles. These can be added to the persons
>normal profile (Add as a supplementary group Profile).  This way any
>logging is directly associated with that profile. Also, the job will
>have the same operational attributes since they are using their normal
>profile.
>

Adding the "FireCall" profiles as supplemental groups would mean that these
programmers would have *ALLOBJ-like authority day in and day out.  That's a
bit more authority than developers ought to operate with on a daily basis, IMHO.

jte



*************************************************
* John Earl Gig Harbor, Washington  U.S.    *
* Email:    johnearl@blarg.net      *
*************************************************

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
umidr

root
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *