Re: Securing output queues

[John Earl <johnearl@xxxxxxxxxxx>]

Loyd,

Goodbar, Loyd (AFS-Water Valley) wrote:

> We have some output queues we wish to secure. The problem is several users
> have *SPLCTL and *ALLOBJ. We want to secure an outq such that only specific
> users can view/change spool files in that queue. I've created an outq with
> public *EXCLUDE, and added an authorizaton list to it. I've revoked my
> ownership of the queue to QSECOFR. Even if my name is not on the
> authorization list, I can still view and change spool files in this out
> queue. My profile has *ALLOBJ and *SPLCTL, among others. What are my
> options?

You've almost got the worst of both worlds here.  If a user has *ALLOBJ
authority, there is no way to prevent them from seeing an out queue.  You can
however prevent an *ALLOBJ user from seeing or changing _entries_ in a queue by
creating the queue like this:

CRTOUTQ OUTQ(QGPL/SECOUTQ) DSPDTA(*OWNER) +
AUTCHK(*DTAAUT) OPRCTL(*NO) AUT(*EXCLUDE)
(Note: example shamelessly lifted from the Security Reference manual)
In this example, only those people who own a file may access the file.... unless
the user has *SPLCTL special authority.

*SPLCTL compounds this issue.  Even if you take away *ALLOBJ, *SPLCTL can be
viewed as *ALLOBJ for spool files.  Just as it's impossible to protect an
_object_ from an *ALLOBJ user, it is also impossible to protect a spool file 
from
a *SPLCTL user.

By way of  a solution, you might consider taking away *SPLCTL authority from all
interactive users.   One view is that *SPLCTL is almost never needed for an
interactive profile.  You might use it for a dedicated batch processes that 
works
with spool files, but for an everyday interactive profile it is definetly
overkill.  A user with *JOBCTL specail authority can work with the entries on an
outq that is defined as *OPRCTL(*YES).  Isn't this enough authority for what 
they
need to do?


hth,

jte



--
John Earl   johnearl@toolnet.com

PowerTech Toolworks  206-575-0711
PowerLock Network Security www.toolnet.com
The 400 School   www.400school.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---