Re: Security Level 20 to Level 30 questions.

[Rob Berendt <robertowenberendt@xxxxxxxxx>]

You do want to read this:
https://www.ibm.com/docs/en/i/7.5?topic=security-planning-object-authority
At, at 7.5, once you go past level 20 there's no going back, well, I
suppose a full system restore may do it.  But you cannot just run a command
and change it back to 20.

But the biggest question is:  Is there some way to run Authority Collection
and see what failures, if any, your users will have if you change QSECURITY
from 20 to 30?
https://www.ibm.com/docs/en/i/7.5?topic=reference-authority-collection

See also:
https://www.dxrsecurity.com/press/mastering-ibm-i-security-by-carol-woodbury
"Understand the steps to take to successfully move the system from
QSECURITY level 20 to 40 or 30 to 40"

On Thu, May 23, 2024 at 4:43 PM K Crawford <kscx3ksc@xxxxxxxxx> wrote:

> I have been wanting to clean this up for some time.  If we get the new
> system it will be time.  I know going to a Power 10 will bump my Level 20
> to a Level 30.  So I am looking at my system to figure out the impact.  I
> know for a fact (don't beat on me for this) that I will need/should change
> user profiles security.  I want to get rid of *ALLOBJ from normal users.  I
> want to change the User Class to *USER.  I have set up a user to test with.
>
> Questions:
> 1. for your everyday users what "User Class" and "Special Authorities" do
> they have?  I know it depends.
> 2. In our initial program it sets up the library list.  I have the library
> QHTTP in it.  This fails with CPF2182 - Not authorized to library.  Looking
> at QHTTP it has *PUBLIC *EXCLUDE.  Any suggestions?  Add a group profile to
> the library authority, almost all of our users have a group profile.  The
> reason we have this library in the user library list is some programs call
> items in this library.
>
> I am sure I will have more questions.
> TIA
> --
> Kerwin Crawford
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.