RE: setsppfp bug

> -----Original Message-----
> From: dhandy@isgroup.net [mailto:dhandy@isgroup.net]
> 
> Dave,
> 
> >The LOGINP exposure was "public" knowledge on the /38 back 
> in the '80's -
> 
> I was still stuck on the S/36 then. :(  I do remember reading a Q38
> article (by Ken Kelly?) on how to view the clear-text passwords in
> QSYUPTBL, but at the time I did not work on the S/38...  I didn't see
> the article until I was on V1R1 of OS/400.  (Which is also the last
> time I read it, so I'm not 100% positive on the author.)
> 
> >Even today, I'll bet
> >the answer is likely to be something like "secure your 
> subsystems so that
> >the display files can't be changed illegitimately".  
> 
> I think this is a legitimate answer.  I don't consider this a "bug".
> But neither do I recall ever being told to guard against it, or verify
> before promoting to production that it wasn't added by a rogue
> programmer.  Maybe I just haven't paid enough attention over the years
> and this was common knowledge.  Wouldn't be the first time. <g>

Well, I said "public" - I never said "common" (or even "COMMON" - grin).
You're right, I don't believe I've ever seen any mention of it in anything
from IBM.  And I have to admit that I've never exactly gone out of my way to
mention it to people, nor have I ever seen it mentioned by others in public.
I guess it just seemed so obvious - or maybe I subconsciously didn't want to
cause a lot of concussions from all the head slapping. <g>

At the time he showed it to me, John said that with security settings
as-shipped on the /38, there wasn't a way for anyone without *ALLOBJ to view
QSECOFR's joblog, even on an outq, since the outq's were all secured.  The
problem was that no one ever left the security on the outq's, so the joblogs
became exposed.  The addition of the *SPLCTL special authority on the /400
made the exposure greater, of course, since that authority is so over-used
by so many shops.  I don't remember, on a new install what are the
authorizations on QEZJOBLOG?

Has anyone ever seen this in any of the third-party books on security, like
the ones by Wayne Evans and Wayne Madden?  I don't happen to have any of
them accessible at the moment.  Or is there a mention in any of the IBM
books, white or red?

Dave Shaw
Spartan International, Inc.
Spartanburg, SC
+---
| This is the MI Programmers Mailing List!
| To submit a new message, send your mail to MI400@midrange.com.
| To subscribe to this list send email to MI400-SUB@midrange.com.
| To unsubscribe from this list send email to MI400-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: dr2@cssas400.com
+---