Re: Set up a profile Question

[John Earl <johnearl@xxxxxxxxxxx>]

Torres, Wanda wrote:

> > We are  going to be audited and   I am assigned to clean up.   Our
> > operators  and programmers user profiles have special authority *ALLOBJ.
> > I noticed that IBM commands in QSYS authority have been changed.

Wanda,  don't assume that the default authority to IBM commands has been 
changed,
IBM ships the OS with specific authorities to QSYSOPR and QPGMR profiles.  
OS/400
just comes that way.  You can see the specific details in one of the Security
Manuals.

However, if you have all your programmers and operators running around with
*ALLOBJ authority, you're going to have a devil of a time passing any security
audit.  With *ALLOBJ authority, there is darn little that they cannot do.  
Better
to find out which objects they require access to and engineer a way to get them
authority to those objects.  Don't let *ALLOBJ get (any further) out of control.


jte

--
John Earl
PowerTech Toolworks
johne@toolnet.com
253-858-7388

Riley Nichole Earl, Born 7/6/98 - 8lb 11oz.  Already an AS/400 fan!
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---