Re: Managing access to Host servers

["Todd kidwell" <Todd.kidwell@xxxxxxxxxxxxxxxxxx>]

Evan,

I was looking into something similar last week.  I was leaving the QServer 
subsystem active during my cumulative backups up because I have NT servers that 
connect via ODBC that stay connected 24 x 7.  For some reason, the application 
on the servers require a reboot whenever they lose their ODBC connection to the 
AS/400.  The servers are set up so as not to allow any user-access during my 
backup window.  However, a user recently discovered that even though he cannot 
sign on to the front-end during the backup window, he can access the data 
directly via ODBC.

I checked into one of the security tools - Change Activation Scd Entry 
(ChgActScdE) / options 5 & 6 from the SecTools menu.  It looks like this 
command can effectively enable / disable user profiles, but it does not seem to 
have a lot of options associated with it.  From what I can tell, it would 
require an entry for every individual user (over 1,000).  It would be a lot 
more functional (for me, anyway) if I could specify a schedule for all users in 
a certain group or based on accounting code.

I haven't done anything with this command yet.  I am kind of concerned with any 
performance impact that enabling / disabling mass numbers of profiles may have 
on the system.  With backup windows squeezed as tight as possible already, even 
a few minutes to enabled and a few minutes to disabled may be too much.

I have written several exit programs attached to the ODBC exit points.  I 
suppose another option would be to reject any ODBC-related requests that are 
made during my back-up window?  Hmmmm - this might not be a bad idea.

It will be interesting to see what others have done.

Thanks,

Todd Kidwell (Netstar)
AS/400 System Administrator
(313) 224-0578