Re: Admin's per partition

First of all, I tend to avoid "Let's give QSECOFR to all developers, just
in case they have to do middle of the night support...". We've only been
doing this for a few decades and it's not been a problem. Other generic
'admin' accounts do not happen either.

Then it gets down to who really does Admin type work? I would say a
minimum of two. Here it's the BOFH and me. We both get 4 weeks of
vacation and we are under some edict not to take it at the same time. Yes,
there has been the rare occasion that we're both in the same car going to
the same training. Our boss also has some admin authority and a list of
admin accounts. Technically, you could have a worse boss. Even though
he's far removed from day-to-day he could do a little in a pinch.

STRSST is not one to forget. I created my own account to that and stopped
using QSECOFR (remember, there's an os QSECOFR and a sst QSECOFR). The
purpose of my own was mainly to be able to get in when my boss screwed up
the password 3 times on the SST QSECOFR. SST doesn't have a whole lot of
auditing like the OS has.

There really is no difference in this type of 'admin' per partition. We
have 11 lpars of IBM i and they are pretty much the same as far as admin
accounts go.

There is one developer who does have two accounts. He's very trustworthy
to only use his higher account for certain Mimix issues.

Occasionally we dole out QSECOFR to some developer installing software
that requires QSECOFR for installation. The BOFH is supposed to change
passwords on QSECOFR regularly but it's often been when some obscure
database connection stops working because it expired.

There are two others who have access to much of BRMS. 2 or 3 times a year
one of these people cover doing tapes for the BOFH and I. This helps to
ensure cross training and that our documentation is up to date enough that
someone else can understand it.

Then there's Lotus Notes admin, and Tivoli Identity Manager. Basically
the BOFH and I.

Then there's application admin, like adding users to Infor and that menu
security. One area of the department adds their IBM i authority and the
Systems analysts for Infor add the users menu options. All is keyed off
of a nice workflow process which goes through Lotus Notes. (No, not
email. Actual workflow process. Notes is SO much more than just email.)




Rob Berendt