Re: Security in 6.02 and 6.04

[DAsmussen@xxxxxxx]

Dear Fmanriq,

I cannot believe that, in all this time, you haven't even received a "please 
clarify this" question.  For security, you start at the BPCS level assigning 
people as users and allowing access on a program-by-program basis via SYS600. 
 Later versions (yours included, I believe) allow function key and action 
code security for a limited number of programs.

The _real_ security starts at the AS/400 (iSeries/400) level, and SSA/GT does 
not support this because I do not believe that they have a single person "in 
house" that understands AS/400 security.  However, I have implemented the 
following scenario at a client site without repercussions.  Understand that 
it helps if you have a development machine to test this on first.

Everything is set to an ownership of "SSA".  This is an SSA requirement, even 
though object ownership is irrelevant in the overall scheme of AS/400 
security.  All programs and files are set for *PUBLIC to *EXCLUDE.  This 
prevents anonymous FTP and ODBC from accessing critical files.

What, specifically, are you trying to secure?

Regards,

Dean Asmussen
Enterprise Systems Consulting, Inc.
Fuquay-Varina, NC  USA
E-mail:  DAsmussen@aol.com

"There is one difference between the taxidermist and the tax collector -- the 
taxidermist leaves the hide." -- Mortimer Caplin

In a message dated 1/31/03 11:57:53 PM Eastern Standard Time, 
fmanriq@yahoo.com writes:


> We have some BPCS instalation in a customer versions
> 6.02 and 6.04.
> 
> We need to know which general security issues could we
> implemented for improve security.
> 
> How can we improve security by ODBC connection.
>