Re: Op's nav - Graphical UPDDTA

Is the hole as big as you fear?  Try the same thing as a user with lesser 
authorities.  We discovered that it only reflected the real authorities of 
the AS/400 and granted nothing that wasn't already granted.  In other 
words, if the holes you found frighten you then you may have more serious 
security issues than you imagined.  We also discovered that tightening the 
holes was not as horrible as we feared.  Ops Navigator has some wonderful 
tools for that.

_______________________
Booth Martin
boothm@earth.goddard.edu
http://www.spy.net/~booth
_______________________




Rob Berendt <rob@dekko.com>
Sent by: owner-midrange-l@midrange.com
03/24/2000 01:24 PM
Please respond to MIDRANGE-L

 
        To:     MIDRANGE-L@midrange.com
        cc: 
        Subject:        Op's nav - Graphical UPDDTA


How do we turn off the Database portion of Operations 
Navigator?  I played with this before but it took a seminar 
yesterday to point out this glaring security breach to me 
yesterday.  Granted we could use object security, but the 
reality of that being implemented anytime soon is slim to 
none.  The breach is this:
Open Op's nav
Expand your 400
Select database
Select libraries
Select a library
Find a database and double click on it.
There you go, a graphical UPDDTA, for all your users to share!
 And if you right click on the database, you can add fields and 
do all sorts of funky things to a table.  Graphical DDS?

Please, no flames on how I shouldn't ask the list this question,
because then more people will know about this hole.  The hole
already exists.  How do we plug it?
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to 
MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: 
david@midrange.com
+---




+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---