RE: How do you manage your QSECOFR profile and other Q profiles?

We do not use any of the Q profiles unless we absolutely need to. Only
one person knows QSECOFR, me, and I check it once in a while to see if
someone changed the password. I have 3 operators that can change it if
need be so there is no reason to write down the password and place in
safe. Though that is an accepted practice. I don't think we have ever
signed on as QSYSOPR, at least since I have taken over the department.
I would not worry about the 90 day expiration on the unused profiles.
Just set a strong password and forget about it. But make sure you have
it if you need it, though I have been using the AS400 since 1988, I have
never HAD to sign on as QSECOFR except to install third party software.
Now I question why QSECOFR and usually do not for software installs.

Just remember to audit the use of all the Q profiles and check to see if
someone is abusing them.




Chris Bipes
Director of Information Services
CrossCheck, Inc.


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Burns, Bryan
Sent: Monday, August 11, 2008 12:40 PM
To: MIDRANGE-L@xxxxxxxxxxxx
Subject: How do you manage your QSECOFR profile and other Q profiles?

We have a small shop and the five of us - two developers, an
administrator, a manager and a VP - all have powerful enough profiles
that we rarely need to sign on as QSECOFR or any other Q profile.

Because of the powerful profiles we have, we don't really have a policy
on usage of the QSECOFR profile but I need to write a policy and manage
the QSECOFR profile properly. What's the best practice here? Should
just one person know it and keep it a record of it in the safe, so if
he's not here, someone can at least get at it?

What about changing it? It seems kind of senseless and error prone to
change it every ninety days in accordance with the rest of our policy if
it hasn't been used in 90 days.

QSYSOPR hasn't been used since August 2000. Do any of you use the
QSYSOPR profile? I'm thinking the administrator (that'd be me) should
start using it as a day to day profile just for tracking purposes.