Re: Limiting user to device

Multiple ways of handling this:

CHGAUT OBJ('/qsys.lib/*.devd')
       USER(DUDETTE) 
       DTAAUT(*EXCLUDE) 
       OBJAUT(*NONE) 
Then add them to the one device.  As a backup (and this can get hairy) you 
should WRKSYSVAL QCRTAUT and change that to *exclude, or try CHGCMDDFT 
CRTDEVDSP NEWDFT('AUT(*EXCLUDE)').  That's a little less hairy.  But you 
then have to open them up to the rest of the users.  But if you don't do 
this, DUDETTE could create a new session and get in.

INLPGM doing a RTVJOBA to determine session ain't bad.  I do this to make 
sure that user BACKUP only signs on to the system console.  But it's a 
simple trick to type in *NONE on initial program on the signon screen and 
get past that.  You better make them limited capability.  There's always 
some bigmouth.  Like when we do period end we rename the initial program 
BPCSMENU and now half the users know the renamed version.

There's also an exit point that can be used to secure them.


Rob Berendt