Re: ODBC traffic

We're probably vulnerable on the same front, and mostly ignorance has kept
things running smooth so far. To add to Charles's suggestion, you may have
to secure the files from change, his #1, but then give whatever programs
users might use to change the data a heightened authority through adopted
authority.

For example, our item master program is owned by a user profile (We'll call
it SSA) that noone actually signs in with. The program is granted adopted
authority by *OWNER, and the SSA profile is listed as *ALL authority in the
item master file's authority list. In summary, users can't change the file
unless they do it in item master maintenance.




From: Charles Wilt <charles.wilt@xxxxxxxxx>
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Date: 04/12/2016 03:45 PM
Subject: Re: ODBC traffic
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



The only way to do this would be on the IBM i side.

Either
1) Using object security, make sure the users only have *USE authority the
data.
2) Spend $$$ for a package of exit point programs to lock down what's
allowed.
3) roll-your-own #2

An example of #2
http://www.helpsystems.com/powertech/products/network-security



On Tue, Apr 12, 2016 at 3:16 PM, Hoteltravelfundotcom <
hoteltravelfun@xxxxxxxxx> wrote:

HI We have some users who use ODBC connection in Excel to look at IBS

data

on the IBM i.

Now I am getting more requests for this.

I never liked this. Now I want to ensure that this can be one way traffic
only (read only). How can I ensure this. Secondly, I noticed that all

users

with green screen get icons of the Windows for IBM ISeries access. In

these

Icons are also links for sending and receiving data with IBM i.

I don't like this either. We have a few users on green although most not.

Can I remove these icons globally? Or has to be one by one.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related
questions.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.