RE: Anti-virus for i5OS

There is a difference between *ALLOBJ authority and QSECOFR. My main
issue here is with the requirement to use QSECOFR. I also have issues
with the requirement of *ALLOBJ but that is a separate one and easier to
justify in certain cases. It is each admin's responsibility to be aware
of and develop their own security standards. In our case we rarely if
ever use the actual QSECOFR profile.

Remember, QSECOFR does not just have *ALLOBJ, it also has *AUDIT,
*IOSYSCFG, *JOBCTL, *SAVSYS, *SECADM, *SERVICE and *SPLCTL.

Sorry, but a user with *ALLOBJ can give themselves *AUDIT, *IOSYSCFG,
*JOBCTL, *SAVSYS, *SECADM and *SPLCTL. From "Expert's Guide to OS/400 and
i5/OS Security", page 67:

"For example, *ALLOBJ special authority gives a user unlimited access to
and control over ALL objects-a user with *ALLOBJ special authority can
perform any function on any object on your system."

There is only a one step difference between a user with *ALLOBJ and
QSECOFR, that of the user with *ALLOBJ going into their own profile and
granting themselves the missing options. You can lock both *ALLOBJ users
and QSECOFR out of certain sysvals by pushing them up to SST level
maintenance, but if you've given a user *ALLOBJ you might as well have
made them QSECOFR.

Do you want your new software package to adjust your auditing level,
create a PPP connection and add a job schedule entry that calls home and
reports **anything it wants** from your system? ABC Corp may have just
used "social engineering" to get you to install your very own iSeries
virus!

A totally false question. Who is going to say yes? The point is that
merely changing the user id used for installation from QSECOFR to one with
*ALLOBJ hasn't fixed anything. I can do anything with *ALLOBJ that I can
do with QSECOFR. The user with *ALLOBJ has full rights to the QSECOFR
profile. If he doesn't, he can just grant himself those rights.

As hinted at above, you can push auditing values to SST level, so that
even QSECOFR can't change them. The point remains, *ALLOBJ is essentially
no different from QSECOFR..........