Re: [BPCS-L] Fix that SSA *Allobj Security Exposure!

[Al Mac <macwheel99@xxxxxxxxxxx>]

We also have within the SSA Security Group a special user that has the 
*ALLOBJ and other high security access, that we use for loading upgrades, 
and doing 400 security work that needs to have the resulting objects end up 
being owned by SSA ... this high-security user deliberately is not setup to 
be using BPCS menus and programs, because I not want someone to be using it 
by accident outsicde of the reasons for its existence.

I had this early on because a shipment from SSA could not be installed 
because it "belonged" to a profile not on our system, so I created that 
profile, and used it for installing tapes from SSA.

I too have experienced multiple times with employees of consultants who 
need to do something, and see that compromising security is the ideal 
approach.  After every visit of consultants, I have found that it is a good 
idea to check ZSC and if QSECOFR has shown up there again, to DFU delete 
it, because if we ever have a BPCS security crash again, I know that you 
cannot sign on as any user that is in there.

There are several outfits that provide general 400 security education, and 
some of them have BPCS specific advice, about what needs to be fixed, and 
the hassles and implications.

-
Al Macintyre  http://www.ryze.com/go/Al9Mac
Find BPCS Documentation Suppliers 
http://radio.weblogs.com/0107846/stories/2002/11/08/bpcsDocSources.html
BPCS/400 Computer Janitor at http://www.globalwiretechnologies.com/