Re: Directory Trees on the IFS (Security)

["Jeffrey Silberberg" <jsilberberg@xxxxxxxxxxxxxx>]

Ed,

        This is what I thought but  if I give a user autorization at Level 3
of a tree,
does it not cascade up or down from there ???

    JMS..

----- Original Message -----
From: <edfishel@us.ibm.com>
To: <midrange-l@midrange.com>
Sent: Tuesday, November 07, 2000 1:52 PM
Subject: Directory Trees on the IFS (Security)


> Jeffrey,
> >        I have a quick question.  Has anyone worked with the directory
> >  tree
> > on the IFS enough to
> > have found a way to keep users from walking up the tree to the root.
> > Home
> > Directory is not enough to
> > keep users from walking back up..
> >
> >        The problem is I have a tree that branches 2 levels down, and
user
> > should only have access to branch 1, and User 2 should only have access
to
> > Branch 2 and neither user should be in common portion of the tree for
any
> > reason, but they need to be able to FTP data into there respective
> > trees....
>
> Use authorities on the directories to prevent users from going where you
do
> not want them to go. For example, each user should have *X (search)
> authority to each directory in the path to their home directory. They
> should also have *RWX authority to their own home directory and *EXCLUDE
> authority to everyone else's home directory. The *PUBLIC should have
> *EXCLUDE authority to all home directories. This will allow your users to
> walk up the tree to the root but prevent then from getting into anyone
> else's home directory.
>
> One other think to consider. The public should have *RWX authority to /tmp
> but that is probably one of the only directories to which the public
should
> have write authority. You may want to monitor (audit) the use of all
> directories where the public has *RWX authority. You may want to review
the
> authorities on all other directories in root.
>
> Ed Fishel,
> edfishel@US.IBM.COM
>


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---