Re: VIRUS Alert for the LIST -- MIDRANGE-L

Emilio,

Emilio Padilla Taylor wrote:
> 
> In one shop, we created a user with password(*none), spcaut(*allobj), gave
> this user ownership of all BPCS objects, and change all BPCS programs to
> adopt authorization, no user had real authorization over the objects.  So if
> you want to delete an object with BPCS it will run, but no if do it any
> other way.

You've described a variation of Apllication Only Access, and it's
generatlly a good system, but I have a question.... why give this
profile *allobj?

If the profile already owns everything(which means they have *ALL
authority to objects in the package), and every user adopts the owner
profile's authority while in the package, then every user essentially
has *ALL authority to every object in the package.  So the purpose of
*allobj escapes me.  It gives the owner of the package dominion over
any and every other package/object on the system, including the OS,
and surely isn't a requirement of bpcs???

jmho,

jte

 
> Yes, it had a some impact over performance but, it's a price you had to pay
> for security.
> 
> Emilio Padilla
> 
> ----- Original Message -----
> From: "Chuck Lewis" <clewis@iquest.net>
> To: <MIDRANGE-L@midrange.com>
> Sent: Martes 28 de Diciembre de 1999 04:17 AM
> Subject: Re: VIRUS Alert for the LIST
> 
> Amen !
> 
> Personally, I am SO glad that I do not have to be responsible for the mess
> THAT shop is
> in. I TRIED in vain to explain the risks of doing something like that. And
> this was back
> in the pre-TCP/IP days of the AS/400 (unless you had purchased it...), EARLY
> ODBC days
> and I could SEE where this was headed (and no, I DON'T claim to be prophetic
> <BG> !)...
> 
> Chuck
> 
> "L. S. Russell" wrote:
> 
> > Glad to see I am not the only one who has been unsuccessful in arguing
> with those NCS
> > consultants. Now I don't feel so bad :)
> >
> > Chuck Lewis wrote:
> >
> > > HOW could I have forgotten THAT !!!
> > >
> > > I remember WELL at my last job, the BPCS consultants convincing the
> powers that be
> > > (over my objections) that "we need to have all object authority granted
> so this
> > > will run..." Dumb, dumb, dumb...
> > >
> > > Chuck
> > >
> > > "L. S. Russell" wrote:
> > >
> > > > BPCS users are!
> > > >
> > > > On Mon, 27 Dec 1999, John P Carr wrote:
> > > >
> > > > >
> > > > >
> > > > >
> > > > > >Rob Berendt@rob@dekko.com@SMTP@EXCHCONNECT
> > > > > >Again, this boils down to how you define a virus.  If some
> shareware
> > > > > >decides to delete everything in QSYS is that a virus?
> > > > >
> > > > > It would have to have "Authority" to do that.    How many
> users/programers
> > > > > could put a 4 next to all the objects in QSYS and delete alot of
> them?
> > > > >
> > > > > Alot I bet.
> > > > >
> > > > > Are Programers and Users viruses?
> > > > >
> > > > > John Carr
> > > > >
> > > > > +---
> > > > > | This is the Midrange System Mailing List!
> > > > > | To submit a new message, send your mail to
> MIDRANGE-L@midrange.com.
> > > > > | To subscribe to this list send email to
> MIDRANGE-L-SUB@midrange.com.
> > > > > | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> > > > > | Questions should be directed to the list owner/operator:
> david@midrange.com
> > > > > +---
> > > > >
> > > >
> > > > +---
> > > > | This is the Midrange System Mailing List!
> > > > | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> > > > | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> > > > | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> > > > | Questions should be directed to the list owner/operator:
> david@midrange.com
> > > > +---
> > >
> > > +---
> > > | This is the Midrange System Mailing List!
> > > | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> > > | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> > > | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> > > | Questions should be directed to the list owner/operator:
> david@midrange.com
> > > +---
> >
> > --
> > L. S. Russell Programmer/Analyst
> > Datrek Professional Bags, Inc.
> > 2413 Industrial Drive
> > Springfield, TN. 37172
> > mailto:leslier@datrek.com
> > http://www.datrek.com
> > --
> >
> > +---
> > | This is the Midrange System Mailing List!
> > | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> > | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> > | To unsubscribe from this list send email to
> MIDRANGE-L-UNSUB@midrange.com.
> > | Questions should be directed to the list owner/operator:
> david@midrange.com
> > +---
> 
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
> david@midrange.com
> +---
> 
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

--
John Earl                                          
johnearl@powertechgroup.com
The PowerTech Group                        206-575-0711
PowerLock Network Security              www.400security.com
The 400 School                                www.400school.com
--

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---