Re: Security question

[Vern Hamberg <hambergv@xxxxxxxxxxxxxx>]

Kenneth

At 01:26 PM 4/10/1998 -0700, you wrote:
>Midrangers....
>
>What, if any, difference is there between the following two methods of
>giving a user access to a command screen with QSECOFR authority:

A followup--

In my previous post, I answered as I did, because we have written it this
way. Steve G. and Simon C. are correct, if you use the API as you've
specified.

We use the API, but in combination with adopted authority. We change the
user profile's auditing (so that everything is logged in the audit
journal), use the API to set the profile in the job, and then give the user
(usually a programmer, with special needs--we do this through a carefully
controlled protocol) a command line that adopts QSECOFR's authority. There
are a number of controls to keep this fairly secure.

In this circumstance, the QSYGETPH API is run over the user's profile, not
QSECOFR.

I think our code is based on a NEWS/400 article.

Anyone interested in more (including code), let me know private email.

Cheers

Vernon Hamberg
Systems Software Programmer
Old Republic National Title Insurance Company
400 Second Avenue South
Minneapolis, MN 55401
(612) 371-1111 x480


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---