RE: [Security400] Removing *ALLOBJ from user profile

Steve,

This is not a definitive answer but from experience a couple things I
ran into when removing *ALLOBJ.

1) CRTSAVF defaults to *PUBLIC *EXCLUDE. So that might need to be taken
into account.
2) If those involved need to look at job logs, they will not be able to
see any job log created by a user that does have *ALLOBJ. A work around
for this is
CHGFCNUSG FCNID(QIBM_ACCESS_ALLOBJ_JOBLOG)
USER(<usrprf>)
USAGE(*ALLOWED)

Those were the main two when I removed that authority from a selection
of user profiles.
Other problems can be worked around with adopted authority,
groups/authorization lists, or a combination of both.

I don't know any way to 'look ahead of time' - I'm sure our production
Administrator would love to know if there is one

Cheers

James P. Wiant
Test System Administrator
Foodstuffs, Auckland, Ltd.
60 Roma Road
Mt Roskill
Auckland, New Zealand 1041
09-621-0774
jim.wiant@xxxxxxxxxxxxxxxx



The quality of an organization can never exceed the quality of the minds
that make it up.

Unknown

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
bdietz400@xxxxxxxxx
Sent: Friday, 11 December 2009 10:45
To: Midrange Systems Technical Discussion
Subject: Re: [Security400] Removing *ALLOBJ from user profile

You will have to look at using the CHGUSRAUD command.
that will should you what gets used "touched" but not the effect of
removing the special authority.

Bryan


On Dec 10, 2009 3:43pm, Steve McKay <steve.mckay@xxxxxxxxxxx> wrote:

I have a user profile that is not used to sign-on but has *ALLOBJ
authority.

I want to revoke *ALLOBJ from the user profile but I don't want to

break

any

production jobs. How can I determine what the effect might be if I

remove

*ALLOBJ? Can I do something with the audit journal to display all the

things that this user profile might touch in the course of the day?

Thanks for your help!

Steve

_______________________________________________

This is the Security Administration on the AS400 / iSeries

(Security400)

mailing list

To post a message email: Security400@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/security400

or email: Security400-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/security400.