Re: auditing commands

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

"Graziano, Marie" wrote:

> True,
> However if the command is tagged as Allow Lmtd User = NO.  then they should
> not be able to do it.

I agree that they _should_ not be able to execute those commands, but if you've
got client access, go ahead and try it for yourself and you'll see that that is
doesn't.   LMTCPB(*YES) is only effective for command lines(QCMD, QCMDEXEC, and
QUSCMDLN, etc.), and post V4R2 FTP remote commands.  Other command processing
interfaces such as Client Access and DDM don't pay attention to the LMTCPB flag.


> Also, Most security officers turn the allow RMT
> command off.

Cool, how do you that?

> One more note, if the user profile is setup for  the following then the
> security can be tied down one more step.
> Initial program  .
>         Library  . . . .
> Initial menu . . .
>         Library  . . . .
> Limit capabilities

Marie,   This is called menu security, and on the AS/400 it is a farce.  There
are numerous ways (170+ at my last count) of getting at your data that will pay
no heed to INLPGM, INLMNU, & LMTCPB. If you're not using something beyond menu
security to lock down your data (and your commands!) then you're likely wide 
open
to all of the usual network access protocols (FTP, ODBC, DDM, etc. etc.).

To get back to the original point of this thread, there are decent tools in 
place
for auditing AS/400 commands, but the antiquated notion that we can use LMTCPB 
to
prevent command execution altogether has got to go.  It's part of that old menu
security paradigm that has lived way past it's effectiveness.

jte





--
John Earl                    johnearl@400security.com
The PowerTech Group          206-575-0711
PowerLock Network Security   www.400security.com
--



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---