Re: Specifying a user on the SBMJOB

[John Earl <johnearl@xxxxxxxxxxx>]

Graap, Ken wrote:

> >The cleanest way would be to create a new communications entry in the
> >QCMN subsystem of the remote system that specifies a unique mode
> >description and the user id...
>
> Make sure you carefully secure the *MODD and the DDMFILE on the source
> system though. I'd suggest, *PUBLIC *EXCLUDE and then defining private
> authorities as needed.

Unfortunately DDM security is more complicated than that.  Though it is a good
idea to secure the DDMF on the source system, any DDM host (which can include 
all
of the PC's in your organization) could be pointed at the DDMF on the Target
system.  A named device in the communication entry  will certainly help the
matter, but if you're not using the APPC parameter LOCPWD then you can't really
be sure who is at the other end of the conversation

>
>
> This configuration allows access to your remote system without a password!

DDM as shipped from Rochester already allows access to your AS/400 without a
password.   It's just that the access is allowed as QUSER.   Not a problem if 
all
your authority is regulated to group profiles, but a Big problem if *PUBLIC has
authority to sensitive objects.

> Referencing this DDMFILE / *MODD combination when using the SBMRMTCMD
> command effectively gives a SOURCE system user the ability to run ANY
> command the TARGET system user is authorized to run...
>
> i.e. SBMRMTCMD CMD('PWRDWNSYS *IMMED') DDMFILE(DDMLib/DDMfile)

Again, this problem already exists.   It's just that the commands or file
operations default to run under QUSER authority and, QUSER is a member of
*PUBLIC.....

jte



--
John Earl                                              johnearl@toolnet.com
PowerTech Toolworks                         206-575-0711
PowerLock Network Security              www.400security.com
The 400 School                                    www.400school.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---