Re: Modernization and multi-member files

Lukas

I think you missed the distinction presented - to get at the SST functions you need a completely distinct user ID - a standard iSeries ID cannot get there. Not even if they have *SECOFR class can they do it. And to be able to change the QSECOFR DST password, you have to BE QSECOFR in the OS.

On Windows, anyone with enough authority can get at the underlying stream files - again, not something easily done on iSeries.

In other words, the same security system as regular Windows, controls access to the underlying files. On i you need to be enrolled in a completely separate security system.

Regards
Vern

-------------- Original message --------------
From: "Lukas Beeler" <lukas.beeler@xxxxxxxxxxxxxxxx>

On Thu, Jul 17, 2008 at 3:20 PM, Wilt, Charles wrote:

With the right OS permissions, you can open the file and read/write to it with

any program you want.

Of course the format is pretty complex, but if you're smart enough it can be

done.

Actually, IBM i does have a similar interface that I'm pretty sure doesn't go

through the DB. Service

tools includes a hex editor that allows you to edit most (all?) objects on the

system directly. And

before Dave jumps in, this isn't the same as the hole describe above since the

service tools have

their own set of user IDs and authorities. A standard OS user with authority

to the file would not be

able to use service tools.

And neither would a user with authority to a specific database or
table would have access to the underlying database files. In fact, it
is very unusual that someone who accesses a database has
administrative privileges on the database server itself.

As such, the level of security provided on the i and on any competing
platform is exactly the same. You will need a high set of privileges
to access the extended SST functions for directly modifying storage,
and you will also need a high set of privileges to directly modify
database files on a Windows box.