RE: Securing an outq

midrange-l-request@xxxxxxxxxxxx wrote:

>   3. Re: Securing an outq (Vern Hamberg)
>
>Look in the archives for SPLCTL and JOBCTL. OUTQ security is a little
>weird.

I'm not disagreeing, Vern, just making general comments...

I'm not sure I'd classify it as "weird" though it sure seems that there's major confusion out there about special authorities. (And I have my own confusions at times.)

Within the world of spooled files, *SPLCTL might as well be viewed the same as *ALLOBJ for most objects. By granting a "special authority", you're telling the system that it can ignore relevant authority checks and simply grant access. It doesn't matter what's been applied for authorizations; _this_ user is "special" and the normal authorizations are not to be applied.

Too many sites grant the blanket authority rather than maintaining only the needed authority. And also leave accounting turned off so nobody can tell what happened to the spooled file after it was created. And also leave auditing off so there's no trace. And also... ask how to tell what happened after the report is lost.

If all of this weren't so easy to do under Windows, there wouldn't be so much confusion under OS/400.

Tom Liotta