Re: ODBC Security

[John Earl <johnearl@xxxxxxxxxxxxxxx>]

Quazy wrote:

> How does everyone deal with security on the 400 and the ability to use ODBC?
>
> If production files are set to public authority to *change, what can I
> do.  users don't have access to manipulate the data from the AS/400 (I have
> taken all those ways away).  But even if a user with basically no authority
> gets on through ODBC they could do anything they want to the database.

The problem is not ODBC, but rather *PUBLIC=*CHANGE.  If *PUBLIC=*CHANGE then 
any
valid user will be able to change your data through any number of interfaces
(ODBC, FTP, DDM, etc.).  You can block access with exit programs to keep people
from accessing data, but don't stop there.  I would strongly encourage you to
tighten up *PUBLIC's authority.  In a networked environment, *PUBLIC is
potentially any computer on th eplanet.

jte


--
John Earl                    johnearl@400security.com
The PowerTech Group      --> new number --> 253-872-7788
PowerLock Network Security   www.400security.com
--


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---