Re: QSYUPTBL

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Gary Guthrie wrote:

> Yeah, and those shops with programmers belonging to group profile
> QPGMR...

Yes, and any shop running at QSECURITY level 30.

Or any shop where the QSTRUPPGM is not secured.

Or any of the myriad other ways to assume QPGMR's identity.  This is just one
more in a long list of reasons to lock QPGMR down and not use it in your
applications.

jte


>
>
> Gary Guthrie
> REAL Solutions Technical Support
> NEWS/400 Technical Editor
>
> Scott.Lindstrom@zenith.com wrote:
> >
> > At least (by default) only QSYSOPR, QPGMR, QSRV, and QSRVBAS are authorized
> > to this command.  Everyone else is excluded.
> >
> > Scott Lindstrom
> > Zenith Electronics
> >
> > Gene,
> >
> > > In addition to storing passwords in ciphertext, OS/400 stores
> > > passwords in plaintext, too.  For example, after User A signs on,
> > > User B can type the following and see User A's plaintext password
> > > (provided User A and User B are signed on in the same subsystem):
> > >
> > > DMPSYSOBJ  OFFSET(210  1B0  10)  SPACE(0  14)
> >
> > An interesting twist on sniffing passwords. If a user has access to
> > DMPSYSOBJ, it sure beats sniffing the IP packets for telnet sessions !
> >
> > +---
> > | This is the MI Programmers Mailing List!
> > | To submit a new message, send your mail to MI400@midrange.com.
> > | To subscribe to this list send email to MI400-SUB@midrange.com.
> > | To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
> > | Questions should be directed to the list owner/operator: dr2@cssas400.com
> > +---
> +---
> | This is the MI Programmers Mailing List!
> | To submit a new message, send your mail to MI400@midrange.com.
> | To subscribe to this list send email to MI400-SUB@midrange.com.
> | To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: dr2@cssas400.com
> +---

--
John Earl                               johnearl@400security.com
The PowerTech Group                     206-575-0711
PowerLock Network Security              www.400security.com
--


+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---