|
Thomas pending any corrections from security gurus <G> you should also consider that the system request menu can let your users get at the system operator message queue, in fact any message queue, depending on the authority assigned to that queue (at least it used to). Try getting the system request line on your screen then place a 6 on it and hit enter: this is a lifesaver when the system is in restricted mode and the console is input inhibited and QSYSOPR is held. Try getting the system request line on your screen then place a 4 on it followed by another user profile name and hit enter: I discovered the second one at a site where user passwords were sent to the QSECOFR queue but the queue was *PUBLIC read...... I'd have to confess to dealing with this by not putting sensitive stuff into message queues, and dealing with users changing system operator message administratively. My experience has been that this is not easy to mess with on a system that has started using the queue to make things the programmer shodl have handled the operations peoples responsibility <g> Jope this is useful Regards Evan Harris >We had a User "Cancel" a production job (not theirs) by displaying the >QSYSOPR message queue and replying to an outstanding message. The User >doesn't have authority to anything but to their own jobs and menus. On >their menu was the option to "DSPMSG". Once there, they can get to all of >QSYSOPR messages. We found that if a typical *user can do this using the >IBM function, we have an open security issue. Our default "Assistance level >is *intermediate". I am not sure how to close the security hole. Finding >how to turn off the Assistance level so a *user can't change it; or; >changing the *public authority on QSYSOPR. We have programs which write to >QSYSOPR. > >I tested this using a vanilla *user as follows: > >Create a user profile as *user, Initial menu MAIN, limit capabilities to >*yes, make assistance level *Intermediate, no group profile, no special >authorities, QDFTJOBD job description and the rest system defaults. > >Sign on as this user >Displayed is the main menu >Take option 1 User Tasks >Take option 2 Display Messages >Hit F24 for more keys >Hit F21 Change assistance level to 1 (basic) This also changes the >command from DSPMSG to WRKMSG >Note: Function keys at the bottom of the screen now show "F6 Display System >Operator Messages" >Press F6 >Enter a 5 on any outstanding message and reply to it. > >Voila..........Canceled > >I have also found that the QSYSOPR message queue is occasionally cleared. I >could never find who cleared it. Now I think I know how it was done.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.