Profile security

>My guess is that you did not understand your security auditor correctly.
>For example, having PASSWORD(*NONE) is much safer than having PASSWORD
>(*USRPRF). Each user profile that has PASSWORD(*USRPRF) should have its
>password changed. It is not a good idea to give a password to most of the
>IBM supplied user profiles that are shipped with PASSWORD(*NONE).

>Ed Fishel,
>edfishel@US.IBM.COM

I understand that, but can you explain to me how having the mentioned
profiles with Limited Capability equal to *NO and Password (*NONE) can cause
a problem?  By the way, I did not mean to include QSECOFR in the list of
profiles.

His exact words were, "You have too many profiles with Limited Capability
equal to *NO and Password equal to *NONE."  Does that mean that I should
change all the IBM profiles that are not being use to Limited Capability
equal to *YES???



------Original Message------
From: Ray Regalado <rayreg@mail.com>
To: MIDRANGE-L@midrange.com
Sent: March 2, 2001 11:11:50 PM GMT
Subject: [No Subject]


Ed, thanks for the response.

>What are the repercussions from having a profile on the system with the
>following characteristics:
>o   Limited capabilities = *NO
>o   Password = *NONE

I was told that profiles with these attributes needed to be modified because
it was a security risk.  Some of the profiles mention were:
QAUTPROF
QBRMS
QCOLSRV
QDBSHR
QDBSHRDO
QDFTOWN
QDLFM
QDOC
QDSNX
QEJB
QFNC
QGATE
QLPAUTO
QLPINSTALL
QMSF
QNETSPLF
QNFSANON
QPGMR
QPM400
QRJE
QSECOFR
QSNADS
QSPL
QSPLJOB
QSRV
QSRVBAS
QSVCDRCTR
QSYS
QSYSOPR
QTCP
QTFTP
QTMHHTP1
QTMHHTTP
QTMPLPD
QTMTWSG
QTSTRQS
QUMB


______________________________________________
FREE Personalized Email at Mail.com
Sign up at http://www.mail.com/?sr=signup
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---