Re: QDLS Authorities with FTP or SFTP

[Don Brown <DBrown@xxxxxxxxxx>]

Thanks Rob for pointing out that I did explicitly say QDLS was to be used.

Brad - No they are not restricted to Win3.11

As I said in the OP I do not have a choice.  I know QDLS is not the 
correct answer for anything but that is why I said we don't have a choice.

The vendor is dropping IBMi from their supported platforms in the near 
future but the problem needed a solution now.

OK I think I have found a solution and just wanted to share ...

In IBM Navigator for i you can set Allow access or Deny access for the FTP 
Operation ...

Navigation ==> Security ==> Application Administration
Select Host Applications from the left menu
Expand TCP/IP Utilities for iSeries
Expand File Transfer Protocol
Expand Specific Operations
You now have a selection of operations that you can specify 
customisation's for
(Change directory, CL Commands, Clear Command Channel, Create 
Directory/Library, Delete Directory/Library, Delete Files, List Files, 
Receive Files, Rename Files, Send Files)
Select the required operation and Click Customise (Customize for 
Americans!)
You can now specify a list of Users/Groups/Users not in Group to either 
Allow access or Deny Access

So to test I added my test user to the Access Denied operation for Send 
Files. (Sending files from IBMi to Client)

I was then able to ftp the file with a put successfully but trying to do a 
get on that file failed with a not authorised error.

So I am going to create a group profile, add the 200 users to that group 
and then assign the group as Access Denied to the  operations we want to 
restrict.

I think this is going to work very nicely.

Cheers
 


Don Brown





From:   "B Stone" <bvstone@xxxxxxxxx>
To:     "Midrange Systems Technical Discussion" 
<midrange-l@xxxxxxxxxxxxxxxxxx>
Date:   25/03/2020 01:16 AM
Subject:        Re: QDLS Authorities with FTP or SFTP
Sent by:        "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>



Are they restricted to Windows 3.x OS as well?  :)

Sorry I missed that part of the email from the OP.  That is one of the
worst policies I've seen in a while.

On Tue, Mar 24, 2020 at 8:28 AM Rob Berendt <rob@xxxxxxxxx> wrote:

> Brad,
> From the OP
> > > I am restricted by the software that it MUST be in QDLS so please do
> > > not suggest a different file system.
>
> Rob Berendt
> --