RE: QSECOFR was: Anti-virus for i5OS

["Chris Bipes" <chris.bipes@xxxxxxxxxxxxxxx>]

The Point:

You can Audit that profiles activity.  If the profile cannot logon.
Password *NONE initial menu *SIGNOFF and only the specific package uses
the profile, you will pass any security audit.  If QSECOFR owns it, well
there goes your accountability. 


 

Chris Bipes
Director of Information Services
CrossCheck, Inc.


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of ALopez@xxxxxxxxxx
Sent: Wednesday, April 02, 2008 6:53 AM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: QSECOFR was: Anti-virus for i5OS

That inquiry into the details can be a pain.  I've found that a bunch of
TAATOOLs help to profile loaded packages:  PRTPGMSEC, PRTOWNOBJ,
DSPUSRAUT2.  Other tools help fix lousy security schemes. CHGLIBOWN is
valuable for mass changing of a package from its installed owner to a
new one.  Of course, they all either require or work best when run by
QSECOFR. 
 Looking at the help for TAATOOL, there are around 89 programs that run
as
USRPRF(*OWNER) and must be owned by a user with special authority. 

I guess it's possible to install the package and have a profile other
than QSECOFR own the objects.  If that profile still has to have
*ALLOBJ, I fail to see the point.