MIDRANGE dot COM Mailing List Archive



Home » MIDRANGE-L » June 2014

Re: QSYSOPR Security issue for Backups.



fixed

The user profile I replaced was an individual with QSECOFR authority. He
left the company years ago... ROBOT submits the job. Robot does not
allow QSECOFR to submit jobs. QSYSOPR does have authority to backup the
'Entire' systems. I don't have an issue with the weekly backup, just this
BRMS object daily.

It appears QSYSOPR created the object on the previous backup, as he is the
owner....? but doesn't have authority to the object: See below screens
of message and attributes of object:

Not authorized to object. Object is /tmp/brms/q1asav540051.

Object . . . . . . : /tmp/brms/q1asav540051

Type . . . . . . . . . . . . . . . . . : STMF

Owner . . . . . . . . . . . . . . . . : QSYSOPR
System object is on . . . . . . . . . : Local
Auxiliary storage pool . . . . . . . . : 1
Object overflowed . . . . . . . . . : No

Coded character set ID . . . . . . . . : 37
Hidden file . . . . . . . . . . . . . : No
PC system file . . . . . . . . . . . . : No
Read only . . . . . . . . . . . . . . : No

Need to archive (PC) . . . . . . . . . : Yes
Need to archive (System) . . . . . . . : Yes

Object . . . . . . : /tmp/brms/q1asav540051

Creation date/time . . . . . . . . . . : 06/10/14 04:54:14
Last access date/time . . . . . . . . : 06/11/14 07:39:51
Data change date/time . . . . . . . . : 06/10/14 04:56:37
Attribute change date/time . . . . . . : 06/10/14 04:56:37

Size of object data in bytes . . . . . : 404816
Allocated size of object . . . . . . . : 524288
File format . . . . . . . . . . . . . : *TYPE2
Size of extended attributes . . . . . : 0
Storage freed . . . . . . . . . . . . : No
Disk storage option . . . . . . . . . : *NORMAL
Main storage option . . . . . . . . . : *NORMAL

Auditing value . . . . . . . . . . . . : *ALL


Proudly bringing you North America's best-selling
MCI coaches and Europe's top luxury brand, Setra.
Stephanie Cox
Senior Systems Administrator
Motor Coach Industries
7001 Universal Drive
Louisville, KY 40258
Mobile: 502-475-7098
Office: 502-318-3211
Direct Fax: 502-318-8257
E-Mail: Stephanie.Cox@xxxxxxxxxxxx
www.mcicoach.com
www.setra-coaches.com




From: "franz9000" <franz9000@xxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>,

Date: 06/10/2014 10:52 PM
Subject: Re: QSYSOPR Security issue for Backups.
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Stephanie,

When you granted authority to the parent directories, that does not filter

down
to the already existing files.

When you say you changed automatic backup to run " by QSYSOPR", what
exactly
did you change?
It's been a few years since I setup a BRMS shop, and perhaps
others can chime in, but I don't remember ever trying to using QSYSOPR to
run jobs.

If the /tmp file still exists, what is it's authority?
The cmd - wrkaut '/tmp/brms/q1asav540051' will display - need to know
both object authorities and data authorities (F11 toggles)
Jim

----- Original Message -----
From: <Stephanie.Cox@xxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, June 10, 2014 12:47 PM
Subject: RE: QSYSOPR Security issue for Backups.



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Stephanie.Cox@xxxxxxxxxxxx
Sent: Tuesday, June 10, 2014 8:11 AM
To: midrange-l@xxxxxxxxxxxx
Subject: QSYSOPR Security issue for Backups.

I am trying to remove the user who originally set up this iSeries - he's
been gone for years. I have changed the automatic backup to be run by
QSYSOPR -and no matter what - continue to receive this message. 'Not
authorized to object. Object is /tmp/brms/q1asav540051'. Of course the
number changes each day. I have granted authority to QSYSOPR for /tmp
/tmp/brms. Finally I gave QSYSOPR *ALLOBJ authority in the profile -
and
still got this message last night. Any/All ideas would be greatly
appreciated.


Thanks







Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2014 by MIDRANGE dot COM and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available here. If you have questions about this, please contact