Re: iSeries vs IIS web site

[Joe Pluta <joepluta@xxxxxxxxxxxxxxxxx>]

On 4/12/2011 1:17 PM, John Jones wrote:
> If I, with my mad haxxor skillz, can uncover&  exploit a flaw I might gain
> access to the underlying server (probably by running shell commands within
> the web server or by running a shell directly).  Most likely not as
> Administrator/root/QSECOFR but as the user running the web server.

It's mad simple to provide zero update access to the default user 
profile.  Especially on the i, where you can adopt authorities as necessary.

> Now take two scenarios:
> 1. Consolidated environment: I am free to exploit the authority of the
> profile the web server is running on.

Which is entirely read-only.  Thanks for playing our game!

And if you set up an environment where a web user profile can alter the 
server configuration you probably should consider another line of work.

Joe