Re: Auditing adopt authority vs profile handles.

Thank you.
Then I suppose the issue becomes auditing not only those owned by QSECOFR, 
but also those owned by any *ALLOBJ user profile.  Of course, any owned 
versus *USRPRF should be enough of a red flag.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





Martin Rowe <martin@xxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
04/29/2004 01:36 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
<midrange-l@xxxxxxxxxxxx>
cc

Subject
Re: Auditing adopt authority vs profile handles.






On Thursday 29 April 2004 19:10, rob@xxxxxxxxx wrote:
> Well, the latest rage is to audit all programs that adopt authority. 
> Most of the security tool vendors have something to list out programs
> that run under a different user profile (USRPRF *OWNER).  Just got a
> guy here looking at profile handles.  How do you know what programs do
> that?  Or do they also need USRPRF *OWNER to do anything tricky?

I've a few routines that use profile handles which also adopt authority to 

perform the switch. Either you need the password of the profile you're 
adopting, or the profile running the switch needs *ALLOBJ (or full rights 
to the profile in question). Providing the password doesn't seem very 
secure (unless prompted for, maybe) so I assume you'd want 
usrprf(*owner).

Regards, Martin
-- 
martin@xxxxxxxxxx  AIM/Gaim: DBG400dotNet  http://www.dbg400.net   /"\
DBG/400 - AS/400 & iSeries Open Source/Free Software utilities     \ /
Debian GNU/Linux | ASCII Ribbon Campaign against HTML mail & news   X
                                                                   / \
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.