|
Interesting. I'll keep that in mind about QSECOFR being able to use the
system console even when disabled. Does it bark at you and warn you?
There's so much that depends on QSECOFR not being disabled that I would
like to know it is disabled.
From the console:chgusrprf qsecofr status(*disabled)
SIGNOFF
Signed on as QSECOFR.
DSPMSG QSYSOPR. Nothing.
DSPMSG QSECOFR. Nothing.
DSPLOG PERIOD((1335)). Nothing.
DSPJOBLOG. Nothing.
From another session:CPF1394 User profile QSECOFR cannot sign on.
Back at console
chgusrprf qsecofr status(*enabled)
User profile QSECOFR changed.
Granted, if it was disable via QMAXSGNACN there would be one message in
QSYSOPR.
My concern is that a coworker could assist me with one of my downtime
weekends, disable QSECOFR and I not know it. Then stuff stops working and
I waste time trying to figure if it was some new ptf or some such thing.
Right now, if the device is disabled after 3 tries, and the device happens
to be one of our wireless scanners, then Message Labs will vary the device
back on for 5 tries. Effectively raising QMAXSIGN for just those devices
to 15 (3 x 5). I could work with that.
I still do not like them being able to disable ROB, PEGGY, CHRIS and a
host of others so easily though.
Rob Berendt
--
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: bdietz400@xxxxxxxxx
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 03/23/2011 01:26 PM
Subject: Re: QMAXSGNACN
Sent by: midrange-l-bounces@xxxxxxxxxxxx
I prefer disable profile only. I've had too many occasions were the
console
got varied off while at restricted state.
Remember that even if QSECOFR is disabled it can still signon at the
console.
Bryan
On Mar 23, 2011 1:13pm, rob@xxxxxxxxx wrote:
We had "yet another security audit". This time we are getting dinged
because we have QMAXSGNACN sent to 1=Disable device. It is recommended
that we use 3=Disable device and profile. Their concern is that someone
could mount a Denial Of Service attack on us and disable all of our
virtual devices. My thought is, that if I set it to disable userprofiles
wouldn't that just expand the DOS attack to include user profiles also?
Let's see, sign on 3 times and disable QSECOFR, then try QSYSOPR and
several others. Granted, you could use this to recover QSECOFR (which is
quite drastic)
http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzamh/rzamhrecover.htm
or you could sign on as someone else with that level of authority and
reset it there.
Anyone with command line access can do a
wrkobj qusrsys/*all *msgq
and get a list of all your user profiles. I just signed on as this user
crtusrprf dummy
and was able to perform that. (Please do not take offense at the user
name - it's just a habit of mine. The operator knows to kill it on
sight.)
Rob Berendt
--
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
