Re: Authorizing program access

[Simon Coulter <shc@xxxxxxxxxxxxxxxxx>]

On 17/09/2008, at 12:51 AM, Jesper Juul Fjeldgaard wrote:

> This is not correct.

It IS correct. I am very rarely wrong--perhaps twice in 15 years on  
this list. What you describe below does not work. Excluding the group  
is too late. You probably meant step 4 to be:

	Change the PF/LF and enter the user profile to be denied.

Which will deny access but is NOT giving the user *ALLOBJ (as  
specified in the append I corrected) but rather letting them inherit  
it from a group. Then normal authority checks will deny access if ANY  
authority less than that required is found before the group authority  
is checked.

However, it's not a secure mechanism because *ALLOBJ via the group  
gives me ALL authority and I can easily use that to circumvent your  
attempts to deny me access.

You CANNOT** stop an *ALLOBJ user, regardless of HOW they get that  
authority, from accessing ANY object on your system.

**OK, if you deny me access to create programs, call APIs, send  
messages, etc. (effectively stopping me from doing my job also). you  
might be able to limit what I can do with *ALLOBJ access but I'll bet  
you can't close all the holes and the best you can do is make it  
harder form me to circumvent. Reliance on the "inherit from group-- 
deny user"  technique is downright dangerous and flawed because it  
gives a false sense of security,

> If you grant access to a PF /LF you can prevent ALLOBJ users'  
> access by
> doing the following:
>
>
> 1. Create a user profile called ALLOBJ - grant this user ALLOBJ
> authority
> 2. Remove special authority ALLOBJ from your user profiles who are not
> allowed to see the files.
> 3. Add supplementary group ALLOBJ to the users instead.
> 4. change the PF/LF and enter the group profile ALLOBJ as *EXCLUDE.
>
> Then OS/400 will check and exclude the users due to their existence in
> the group profile, and since they no longer have special authority on
> the OS/400 profile they are not granted access.

Regards,
Simon Coulter.
--------------------------------------------------------------------
   FlyByNight Software         OS/400, i5/OS Technical Specialists

   http://www.flybynight.com.au/
   Phone: +61 2 6657 8251   Mobile: +61 0411 091 400        /"\
   Fax:   +61 2 6657 8251                                   \ /
                                                             X
                 ASCII Ribbon campaign against HTML E-Mail  / \
--------------------------------------------------------------------