Re: Why do software companies always want ALLOBJ

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Jim Knight wrote:

> We had the same problem here.  We refused to give them *ALLOBJ rights, period.
> We changed the ownership of all of their objects to a unique user ID with
> full rights, then assigned this as their group profile for dial in.  We also
> created a program that the developers have to call to vary the dial up line
> on, it then monitors usage and after a specified time, it cancels the dial in 
>job,
> varies off the line and disables the user profile for the vendor.  This way 
>they
> can only dial in with our permission.

Jim has got it right!   That is a classic case of a vendor who didn't 
understand the
seccurity implications of their own software, and had to be straitened out by a 
more
sophisticated customer.

And it didn't hurt a bit.

jte

--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---