RE: auditing commands

["Graziano, Marie" <mgraziano@xxxxxxxxxxxxxxx>]

True, 
However if the command is tagged as Allow Lmtd User = NO.  then they should
not be able to do it.  Also, Most security officers turn the allow RMT
command off.

One more note, if the user profile is setup for  the following then the
security can be tied down one more step.
Initial program  .
        Library  . . . .
Initial menu . . .
        Library  . . . .
Limit capabilities

We have special commands written for those users who we feel need to do EX:
WRKSPLF  then this in-house written command has an AUTL on it.  
There are Numerous ways to do this.  One might look at the IBM site Red
Books.  It is a great help!

Marie Graziano

 -----Original Message-----
From:   John Earl [mailto:johnearl@400security.com] 
Sent:   Sunday, July 30, 2000 4:59 PM
To:     MIDRANGE-L@midrange.com
Subject:        Re: auditing commands

"Graziano, Marie" wrote:

> First of All is the users tagged as Limited Users.  Then only the commands
> you specify to allow Limited users will be available to them.

Actually, there are lot's of ways for Limited Capability Users to enter
commands... just don't use the command line.  DDM, Client access, FTP (prior
to
V4R2) all allow limited capability users to enter commnds.   And any one of
those
could allow a limited capability user to create a command and program that
allows
a user to execute otherwise restricted commands.

The limited capability flag is usefull, but it barely protects anymore.

jte



--
John Earl                    johnearl@400security.com
The PowerTech Group          206-575-0711
PowerLock Network Security   www.400security.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---