RE: security hole in interactive sql call statement?

["Lim Hock-Chai" <Lim.Hock-Chai@xxxxxxxx>]

The security hole I'm referring to is actually the call statement.  With 
LMTCPB(*yes), programmer should not be allowed to use call command.  However, 
it can be achieved thru STRSQL session.

We have a exit program (QIBM_QZDA_*)that log all the sql statements (ODBC, 
download, JDBC...).  However, interactive SQL doesn't seems to be process thru 
this exit point.  Strange.


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of Steve Martinson
Sent: Tuesday, November 16, 2004 9:38 AM
To: 'MIDRANGE-L@xxxxxxxxxxxx'
Subject: RE: security hole in interactive sql call statement?


Lim,

QCMDEXC is not a traditional command where you can decide whether to allow
limited users access via ALWLMTUSR, which specifies whether the command can
be entered from the command line on a menu by a user whose profile is set
for limited capabilities, referencing LMTCPB keyword on the Create User
Profile (CRTUSRPRF) and Change User Profile (CHGUSRPRF) commands.

So, at a minimum, you can have a mitigating activity in place whereby you
change the object auditing value of the QCMDEXC program to *USRPRF and the
user auditing value of specific users you want to monitor *ALL, and then
regularly report on who has been accessing the program.  The combination of
the object and user auditing settings will write records for only those user
profiles that have auditing "turned on."  

Also, you could utilize an exit program for the SQL types of activities that
fully records the SQL transactions strings and that allows you to secure
remote (non green-screen) access to specific objects or commands referenced
within the SQL string.  You certainly can write your own program with the
help of some of the very knowledgeable folks on this forum.  Finally, some
third party exit program solutions give you that granularity and some just
memorize an entire transaction string in total, so you would need to decide
what's best for your environment.

Best regards,

Steven W. Martinson, CISSP, CISM
iSeries Security Consultant
NetIQ Corporation
Mobile:  281.546.9836