Re: Programmer DFU access

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Albert,

"York, Albert" wrote:

> John Earl wrote:
>
> >I put together something similar once, and discovered a big problem with
> it.  The
> >spool file can always be manipulated/changed/deleted by the person who
> reated it
> >(even if it's in an outq they have *EXCLUDE authority to :(  ).
>
> >Our solution was to have an automatic SNDNETSPLF ship the spool file to
> another
> >system, into an outq that was *PUBLIC *EXCLUDE.  The new spool file ended
> up
> >being owned by  the owner of the SNDNETSPLF job, so it was slightly more
> secure.
>
> You can also attach a data queue to the output queue. Any time a spool file
> is added to the output queue an entry is added to the data queue. You then
> have a program running in the background which processes the spool file,
> adding it to a log file or whatever.

That's what we did.  Nice, but not bullet proof.   The data queue only triggers
when a splf is dropped into the outq in a "ready" status.  A conniving sort 
could
engineer a number of ways to keep the splf from ever getting to "ready" status 
so
that he could delete it before it got sent.

Theoretically of course.

jte


>
>



>
> Albert York
>
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

--
John Earl                               johnearl@400security.com
The PowerTech Group                     206-575-0711
PowerLock Network Security              www.400security.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---