Profile security

["Ed Fishel" <edfishel@xxxxxxxxxx>]

Ray,

>What are the repercussions from having a profile on the system with the
>following characteristics:
>o   Limited capabilities = *NO
>o   Password = *NONE

Limited capabilities = *NO means that the user can use an command line to
enter any command that they have authority to use.

Assuming that the system is not at security level 10, Password = *NONE
means that the user cannot sign-on. At all security levels, work can still
be done under that user profile if some other user submits a job to run
with that user profile or switches the user profile of their own job.

>Do these system profiles need the following characteristics?
>QLPAUTO => *SECADM
>QLPINSTALL => *SECADM
>QSYS => *SECADM  *AUDIT

Yes QLPAUTO, QLPINSTALL, and QSYS all need *SECADM special authority. QSYS
also needs *AUDIT special authority. For example, if you remove *SECADM
from QSYS then several parts of the system that adopt QSYS will fail to get
the authority they need to work correctly.

Ed Fishel,
edfishel@US.IBM.COM


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---