Re: Library List.

[John Earl <johnearl@xxxxxxxxxx>]

At 09:39 PM 12/9/97 -0500, you wrote:
>"...for security reasons..."????? What security concerns would have you move
>these 2 system libraries to the bottom of the user list?
>

Walden,

For starters, prior to V3R7 both libraries came shipped with *PUBLIC
authority *CHANGE, which means that a body could add a program to this
library that would get invoked instead of some legitimate program.  This can
be a security exposure when you have any sort of security rules enforced by
a program (which is common).  A classic example would be the joe-programmer
that puts a near replica of the payroll program in QUSRSYS, with a minor
modification that enriches the programmer in some way.  When
Jane-payroll-clerk runs payroll, he calls joe-programmer's bogus version (by
virtue of it's place in the library list) and perfoms the dirty deed under
her own profile.  There are even simpler and more damaging versions of this
hack, but you get the idea.  Hacks like this can be difficult to detect.
I've worked at a couple of banks where all ad-hoc manipulations of the
library list were prohibited.  No ADDLIBLE, no CHGLIBLE, no CHGJOBD, etc.
Any program that had the ability to manipulate the library list was
scrutinized intensly.

It's kind of a new concept to those of us who grew up using and loving
library lists, but it is a fact of AS/400 security.

jte


>-Walden
>-----Original Message-----
>From: MCPARTLAND, Stan <stanley.mcpartland@bently.com>
>To: 'MIDRANGE-L@midrange.com' <MIDRANGE-L@midrange.com>
>Date: Tuesday, December 09, 1997 3:26 PM
>Subject: RE: Library List.
>
>
>>If my memory serves me right, QUSRSYS and QHLPSYS first showed up in
>>1988 on the AS/400.  They were not present on the S/38.  We have moved
>>both libraries to the bottom of the user portion of the library list
>>for security reasons.  Some third party software has difficulties with
>>this, especially in the installation routines.  They replace the user
>>portion of the library list and assume that QUSRSYS and QHLPSYS are in
>>the system portion of the library list.  As long as you are aware of
>>this and investigate before running the installation you should not
>>have any problems.
>>
>>Regards,
>>Stan
>>------------------------------------------
>>Stanley A. McPartland
>>Bently Nevada Corporation
>>1617 Water St; Minden, NV  89423  USA
>>Voice: (702) 782-9339  Fax: (702) 782-1382
>>E-mail: stanley.mcpartland@bently.com
>>------------------------------------------
>
>
>+---
>| This is the Midrange System Mailing List!
>| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
>| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
>| Questions should be directed to the list owner/operator: david@midrange.com
>+---
>umidr
>
>

--

John Earl       Lighthouse Software Inc.
8514 71st NW    Gig Harbor, WA 98335
253-858-7388    johnearl@lns400.com

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---