RE: Anti-virus for i5OS

[ALopez@xxxxxxxxxx]

> > > So you would want 5722XE1, iSeries Access for Windows installed under
> a profile other than QSECOFR?  The same thing for Query Manager and
> TCP/IP connectivity Utilities?  Seems way overboard to me.
>
> Absolutely, I don't know that any of these specifically require use of
> the QSECOFR profile.  RSTLICPGM only requires *SECADM and *ALLOBJ
> authority.

I guess my confusion comes from the fact that the only profile with 
*ALLOBJ on our system is QSECOFR.  That will be the only usable profile 
ever on our system to have *ALLOBJ.  Hence we load licensed programs with 
QSECOFR.  If you load a package with another profile that has *ALLOBJ, 
you've given them access to QSECOFR anyway, right? 

That's quite a different question from what the licensed program, or third 
party package, runs under.  I've had my fun battles with an EDI package 
and a spool management software package that seem overly enamoured with 
running under a profile with *ALLOBJ.  In cases like these you normally 
end up knowing more than the vendor's help desk about how their security 
works.  Amazing how many people get totally confused by the fact that you 
want to change one of their programs to run as *USER and can't because the 
program doesn't have the needed data to be changed without recompiling. 

> In the past some software vendors would require the use of the QSECOFR
> profile for installation, then immediately copy it to the profile that
> owns all their objects.  Then their helpdesk could have QSECOFR access
> without having to ask you for it.  Once you give up the control they can
> do anything they want, like using a profile of ABC123 with a password of
> ABC123.
 
How would they access your system without your knowledge?  For the EDI 
package that I'm saddled with, the user profile was disabled and only very 
limited communications was allowed to the package.  While it took 
continuing work to get excess authorities of the owning profile removed, I 
was fairly confident that nobody was using it without my knowledge.  I may 
be wrong (wouldn't be the first time....).