Re: Profile Assistance Level security issue

Thomas

pending any corrections from security gurus <G> you should also consider
that the system request menu can let your users get at the system operator
message queue, in fact any message queue, depending on the authority
assigned to that queue (at least it used to).

Try getting the system request line on your screen then place a 6 on it and
hit enter: this is a lifesaver when the system is in restricted mode and
the console is input inhibited and QSYSOPR is held.

Try getting the system request line on your screen then place a 4 on it
followed by another user profile name and hit enter:

I discovered the second one at a site where user passwords were sent to the
QSECOFR queue but the queue was *PUBLIC read......

I'd have to confess to dealing with this by not putting sensitive stuff
into message queues, and dealing with users changing system operator
message administratively. My experience has been that this is not easy to
mess with on a system that has started using the queue to make things the
programmer shodl have handled the operations peoples responsibility <g>

Jope this is useful

Regards
Evan Harris

>We had a User "Cancel" a production job (not theirs) by displaying the
>QSYSOPR message queue and replying to an outstanding message.  The User
>doesn't have authority to anything but to their own jobs and menus.  On
>their menu was the option to "DSPMSG".  Once there, they can get to all of
>QSYSOPR messages.  We found that if a typical *user can do this using the
>IBM function, we have an open security issue.  Our default "Assistance level
>is *intermediate".  I am not sure how to close the security hole.  Finding
>how to turn off the Assistance level so a *user can't change it; or;
>changing the *public authority on QSYSOPR.  We have programs which write to
>QSYSOPR.
>
>I tested this using a vanilla *user as follows:
>
>Create a user profile as *user, Initial menu MAIN, limit capabilities to
>*yes, make assistance level *Intermediate, no group profile, no special
>authorities, QDFTJOBD job description and the rest system defaults.
>
>Sign on as this user
>Displayed is the main menu
>Take option 1     User Tasks
>Take option 2     Display Messages
>Hit F24 for more keys
>Hit F21    Change assistance level to 1 (basic)  This also changes the
>command from DSPMSG to WRKMSG
>Note:  Function keys at the bottom of the screen now show "F6 Display System
>Operator Messages"
>Press F6
>Enter a 5 on any outstanding message and reply to it.
>
>Voila..........Canceled
>
>I have also found that the QSYSOPR message queue is occasionally cleared.  I
>could never find who cleared it.  Now I think I know how it was done.