RE: Not a security person but.

["Bill Hopkins" <BHopkins@xxxxxxxxxxxxxxxxxxx>]

Thanks Gary I'll recomend that and at the same time hit the books so I 
know if the person knows what they are talking about.
 Thanks
Bill Hopkins





"Gary Monnier" <gary.monnier@xxxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
11/14/2003 01:37 PM
Please respond to Midrange Systems Technical Discussion

 
        To:     "Midrange Systems Technical Discussion" 
<midrange-l@xxxxxxxxxxxx>
        cc: 
        Subject:        RE: Not a security person but.


It sounds like you need to suggest your client perform a security audit.
The authorities you mention should be restricted to only a few profiles.

-----Original Message-----
From: Bill Hopkins [mailto:BHopkins@xxxxxxxxxxxxxxxxxxx] 
Sent: Friday, November 14, 2003 7:49 AM
To: MIDRANGE-L@xxxxxxxxxxxx
Subject: Not a security person but.


This is what I was able to do:

My profile 
*SECOFR 
*ALLOBJ 
*JOBCTL 
*SECADM 
*SERVICE
*SPLCTL 
has init pgm and menu.

EXODUS server profile
*ALLOBJ 
*IOSYSCFG 
has *signoff

I changed EXODUS to have new password the changed to 
have init pgm and menu. I then signon as EXODUS and changed my profile 
to have *IOSYSCFG special authority. Signed back on and started my own 
server.

What should I suggest to the Ops Manager to correct this work around? 
Besides just changing my profile :) Others are out there like this(
mainly 
contractors ) and I'm 
afraid they might come back after they leave. Should I voice my concern
or 
is there one.
Client did know of my actions so I wasn't doing this in the dark just 
showing it to him. But my knowledge is limited in 
this side of things what direction should he go.

Thanks 
Bill Hopkins
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.