RE: How to prevent users from answering messages in QSYSOPR

Restricting access to the system operator message queue

You can improve security by securing printer output, securing workstations, and restricting access to the system operator message queue.

The option for handling messages on the ASSIST menu allows users to use a function key to display the system operator (QSYSOPR) message queue. Incorrect responses to system operator messages can cause problems on your system. Users require *CHANGE authority to respond to and delete messages in a message queue. Only system operators should have this authority. Consult your System Responsibilities form to see who should have the *CHANGE authority to the system operator message queue.

Use the EDTOBJAUT command:

1.Type EDTOBJAUT QSYSOPR *MSGQ and press the Enter key.
2.Press F11 to display detailed object authority information.
3.Give the public *OBJOPR authority, as shown on the sample display, and press the Enter key.


Edit Object Authority

Object . . . . . . . : QSYSOPR Owner . . . . . . . : QSYS
Library . . . . . : QSYS Primary group . . . : *NONE
Object type . . . . : *MSGQ

Type changes to current authorities, press Enter.

Object secured by authorization list . . . . . . . . . . . . *NONE

Object ----------Object-----------
User Group Authority Opr Mgt Exist Alter Ref
*PUBLIC USER DEF X


4.The system changes the Object Authority column to USER DEF (User defined).
5.Press F11 again to display detailed data authority information.
6.Give the public *ADD authority, as shown on the sample display, and press the Enter key.


Edit Object Authority

Object . . . . . . . : QSYSOPR Owner . . . . . . . : QSYS
Library . . . . . : QSYS Primary group . . . : *NONE
Object type . . . . : *MSGQ

Type changes to current authorities, press Enter.

Object secured by authorization list . . . . . . . . . . . . *NONE

Object ---------------Data---------------
User Group Authority Read Add Update Delete Execute
*PUBLIC USER DEF X

7.Use F6 (Add Users) to add users who need to respond to QSYSOPR messages. Give them *CHANGE authority.

Attention: Do not make the public authority *EXCLUDE. All jobs (and users) must be able to add messages to the QSYSOPR message queue.


Reply or Forwarded mail from: Kenneth E Graap