RE: Locking out USRPRF with *ALLOBJ

["John Earl" <john.earl@xxxxxxxxxxxxx>]

> I just signed on to my system with a test userid that was
> copied from
> QSECOFR, tried the command CHGDSTPWD PASSWORD(*DEFAULT),
> and got this message:

Yeah, but...



If I have *ALLOBJ, then I can assume QSECOFR's identity and do whatever
QSECOFR can do.  It takes one more step, but can still be done.

jte



--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com 
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
> bounces@xxxxxxxxxxxx] On Behalf Of Steve Landess
> Sent: Tuesday, June 22, 2004 2:32 PM
> To: Midrange Systems Technical Discussion
> Subject: Re: Locking out USRPRF with *ALLOBJ
> 
> > "Martin Rowe" wrote:
> > Subject: Re: Locking out USRPRF with *ALLOBJ
> > Mind you, an *ALLOBJ user can reset the QSECOFR SST
> profile
> > password to the default, but at least you'd know then
> that it had been
> bypassed.
> 
> Martin -
> I'm on V5R1, and having had to reset my QSECOFR SST
> profile
> several times now, I'll have to disagree with this
> statement.
> 
> I just signed on to my system with a test userid that was
> copied from
> QSECOFR, tried the command CHGDSTPWD PASSWORD(*DEFAULT),
> and got this message:
> 
>                            Additional Message Information
> 
>   Message ID . . . . . . :     CPF2275         Severity .
> . . . . . . :
> 40
>   Message type . . . . . :     Diagnostic
>   Date sent  . . . . . . :   06/22/04      Time sent  . .
> . . . . :
> 14:40:18
> 
>   Message . . . . :   Not authorized to change DST
> password for IBM supplied
>     security capability profile.
>   Cause . . . . . :   Only a user signed on as user
> profile QSECOFR can
> change
>     the DST password for the IBM supplied security
> capability profile.
>   Recovery  . . . :   Have the security officer sign on
> with the user
> profile
>     QSECOFR and change the IBM supplied security
> capability profile
> password.
> 
> 
> Steve Landess
> Austin, Texas
> (512) 423-0935
> --
> This is the Midrange Systems Technical Discussion
> (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/midrange-l.