RE: AF errors after setting up SSH connections with BASH Shell

[Dan Lanza <DLanza@xxxxxxxxxxxxxxx>]

Interesting Aaron.  We follow the idea of least privileged access and have *PUBLIC set to *EXCLUDE.
Do you mind temporarily trying to set *PUBLIC to *EXCLUDE on your machine and restarting a web server to see if AF entries are generated by QTMHHTTP?

-----Original Message-----
From: Aaron Bartell [mailto:aaronbartell@xxxxxxxxx] 
Sent: Wednesday, February 17, 2016 11:02 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: Re: AF errors after setting up SSH connections with BASH Shell

> What permissions does everyone have set for QTMHHTTP on "/QOpenSys/opt".

% ls -all /QOpenSys
drwxr-sr-x    3 aaron    0              8192 Dec 17 11:30 opt


5250> DSPAUT OBJ('/QOpenSys/opt')

                               Display Authority

 Object . . . . . . . . . . . . :   /QOpenSys/opt
 Type . . . . . . . . . . . . . :   DIR
 Owner  . . . . . . . . . . . . :   AARON
 Primary group  . . . . . . . . :   *NONE
 Authorization list . . . . . . :   *NONE

               Data     --Object Authorities--
 User        Authority  Exist  Mgt  Alter  Ref
 *PUBLIC     *RX          X     X     X     X
 AARON       *RWX         X     X     X     X


​HTH,​
Aaron Bartell
litmis.com - Services for open source on IBM i


On Wed, Feb 17, 2016 at 9:53 AM, Dan Lanza <DLanza@xxxxxxxxxxxxxxx> wrote:

> So with further experimentation I noticed if I disable SSHD with 
> "ENDTCPSVR SERVER(*SSHD)" the AF errors still occur.  However if I 
> rename the "/QOpenSys/opt" directory to something else "/QOpenSys/opt-backup"
> while SSHD is off, the AF errors do not occur (not even for the new path).
> This leads me to believe IBM Web Administration for i specifically 
> tries to access "/QOpenSys/opt" if it exists upon startup.
>
> What permissions does everyone have set for QTMHHTTP on "/QOpenSys/opt".
> I'd like to confirm whether or not this is typical behavior before I 
> just set permissions to stop the AF errors.