RE: backups on AS/400; part2

First of all, you customized the system request.  That should do a DSPJOB,
not a WRKJOB.

Yes, you can suspend the job.  Is that a security breach?  No.

And, yes you are right, this person should have LMTCPB(*YES).  This would
lock the people who customized system request to do a WRKJOB.  Unless they
also changed all of their commands to be allowed to run under LMTCPB.

Nothing is fool proof.  Fools are ingenious.



Rob Berendt

==================
A smart person learns from their mistakes,
but a wise person learns from OTHER peoples mistakes.


                                                                                
                                         
                    Evan Harris                                                 
                                         
                    <spanner@ihug.co.nz        To:     MIDRANGE-L@midrange.com  
                                         
                    >                          cc:                              
                                         
                    Sent by:                   Subject:     RE: backups on 
AS/400; part2                                 
                    owner-midrange-l@mi                                         
                                         
                    drange.com                                                  
                                         
                                                                                
                                         
                                                                                
                                         
                    05/30/01 03:55 PM                                           
                                         
                    Please respond to                                           
                                         
                    MIDRANGE-L                                                  
                                         
                                                                                
                                         
                                                                                
                                         




Rob

How about this then:

System request 3 to bring up WRKJOB. Will that suspend the DLYJOB ? My
guess is it will. I seem to recall trying this once before, but I might
check it again at work.

Also, since Dan didn't say whether he was making the profile LMTCPB(*YES)
or not, I'll assume he hasn't and my WRKJOB turns into a hack.

The system request hole can be closed: theres an API or Exit (whose name
escapes me) that can be used to close this hole, or I  guess you could use
an OVRMSGF to override the msgf system request uses to get its options.

Cheers
Evan Harris

<SNIP>

>We're talking about a 1 line CL program here.  Try it and attempt to prove
>me wrong, mortal.
>
>By the way, what is the big hairy about the attention key?  I would be
more
>concerned about the System Request key.  Either one wouldn't hurt this set
>up though.
>
>Rob Berendt

<SNIP>

>How about hitting the ATTN key after sign on and before the DLYJOB CMD is
>invoked?
>
>
>Joe Giusto II

<SNIP>

>Yes.
>
>And to verify, change the initial program to one that only does a DLYJOB
>and try to hack out of that.
>
>Rob Berendt

<SNIP>

>So, let's suppose I create a special SAVEUSER user profile.  It has an
>initial
>program that prompts the user for the parameters by which the backup
should
>be
>run, including a DLYJOB RSMTIME(x) before the system is ended to a
>restricted
>state.  The program ends with a SIGNOFF.  The user profile's initial menu
>is
>*SIGNOFF.  Does that cover all the bases for restricting anyone from being
>able to issue a system request #2 "End previous request"?
>
>Dan Bale

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---