Re: CHGDSTPWD function

I do agree with John, SST needed to be secured.  But calling these things
"User Profiles" and making passwords match was a mistake.

Al

Al Barsa, Jr.
Barsa Consulting Group, LLC

400>390

914-251-1234
914-251-9406 fax

http://www.barsaconsulting.com
http://www.taatool.com





|---------+------------------------------>
|         |           "John Earl"        |
|         |           <john.earl@powertec|
|         |           hgroup.com>        |
|         |           Sent by:           |
|         |           midrange-l-admin@mi|
|         |           drange.com         |
|         |                              |
|         |                              |
|         |           07/26/2002 07:35 PM|
|         |           Please respond to  |
|         |           midrange-l         |
|         |                              |
|---------+------------------------------>
  
>------------------------------------------------------------------------------------------------------------------------------|
  |                                                                             
                                                 |
  |       To:       <midrange-l@midrange.com>                                   
                                                 |
  |       cc:                                                                   
                                                 |
  |       Subject:  Re: CHGDSTPWD function                                      
                                                 |
  
>------------------------------------------------------------------------------------------------------------------------------|




>
> IBM was brain dead when they enabled the creation of user profiles in
DST.

> To use the LPAR API's, the password of the DST user profile and the
OS/400
> user profile must match!

Well, requiring the DST password and the OS/400 passwords to match sounds
like a problem, but passwords in DST are still a good thing - there were
too
many vendor shenanigans before IBM implemented this.  Now, if you are
managing DST passwords well you don't have to worry about a vendor coming
in
and re-arranging your system without your consent.

jte



--
John Earl
www.powertechgroup.com  john.earl@powertechgroup.com
The Powertech Group Inc. Seattle, Washington
Where the Security Experts Live!

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--
----- Original Message -----
From: "Al Barsa" <barsa@barsaconsulting.com>
To: <midrange-l@midrange.com>
Sent: Friday, July 26, 2002 6:37 AM
Subject: RE: CHGDSTPWD function


>
> IBM was brain dead when they enabled the creation of user profiles in
DST.
> To use the LPAR API's, the password of the DST user profile and the
OS/400
> user profile must match!
>
> Al
>
> Al Barsa, Jr.
> Barsa Consulting Group, LLC
>
> 400>390
>
> 914-251-1234
> 914-251-9406 fax
>
> http://www.barsaconsulting.com
> http://www.taatool.com
>
>
>
>
>
>
>                       "Andy
>                       Nolen-Parkhouse"          To:
<midrange-l@midrange.com>
>                       <aparkhouse@attbi.        cc:
>                       com>                      Subject:  RE: CHGDSTPWD
function
>                       Sent by:
>                       midrange-l-admin@m
>                       idrange.com
>
>
>                       07/26/2002 09:30
>                       AM
>                       Please respond to
>                       midrange-l
>
>
>
>
>
>
> Don,
>
> In this case, there really are two QSECOFR profiles; one in DST and one
> in OS/400.  The disabled DST QSECOFR profile can be re-enabled by the
> OS/400 QSECOFR using the CHGDSTPWD command.  It truly might have made
> more sense to call the DST profile something other than QSECOFR.
> (DSTSECOFR?)
>
> Regards,
> Andy Nolen-Parkhouse
>
> > On Behalf Of Fisher, Don
> > Subject: RE: CHGDSTPWD function
> >
> > In the case you cited, you said you had your own DST administration
> > profile.
> > However, the situation requiring a SLIP installation included the
> > condition
> > that no other profile than QSECOFR has DST administration authority.
> It
> > would seem that your case does not match the SLIP installation
> conditions.
> >
> > Or am I confused?
> >
> > Donald R. Fisher, III
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
>
>
>
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@midrange.com
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
or email: MIDRANGE-L-request@midrange.com
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.