Re: Profile security

["Neil Palmer" <neilp@xxxxxxxxxxx>]

It means you should change auditors to one who knows what he's talking 
about.
Does he realize that you can't sign on to a profile with *NONE for the 
password ?

There is nothing inherently insecure in having a user profile with 
PASSWORD(*NONE) and LMTCPB(*NO).
Of more concern would be what authority *PUBLIC (or other users) had to 
those profiles.
Most of the profiles you mentioned are internal IBM profiles, most with no 
public authority to them.
The exceptions being QPGMR, QSECOFR (probably a mistake including it in 
the list), QSRV, QSRVBAS & QSYSOPR.
If you don't currently use the profiles listed above then you have done 
the right thing from a security standpoint by changing the passwords to 
*NONE.

...Neil






Ray Regalado <rayreg@mail.com>
Sent by: owner-midrange-l@midrange.com
2001/03/05 13:19
Please respond to MIDRANGE-L

 
        To:     MIDRANGE-L@midrange.com
        cc: 
        Subject:        Profile security


>My guess is that you did not understand your security auditor correctly.
>For example, having PASSWORD(*NONE) is much safer than having PASSWORD
>(*USRPRF). Each user profile that has PASSWORD(*USRPRF) should have its
>password changed. It is not a good idea to give a password to most of the
>IBM supplied user profiles that are shipped with PASSWORD(*NONE).

>Ed Fishel,
>edfishel@US.IBM.COM

I understand that, but can you explain to me how having the mentioned
profiles with Limited Capability equal to *NO and Password (*NONE) can 
cause
a problem?  By the way, I did not mean to include QSECOFR in the list of
profiles.

His exact words were, "You have too many profiles with Limited Capability
equal to *NO and Password equal to *NONE."  Does that mean that I should
change all the IBM profiles that are not being use to Limited Capability
equal to *YES???



------Original Message------
From: Ray Regalado <rayreg@mail.com>
To: MIDRANGE-L@midrange.com
Sent: March 2, 2001 11:11:50 PM GMT
Subject: [No Subject]


Ed, thanks for the response.

>What are the repercussions from having a profile on the system with the
>following characteristics:
>o   Limited capabilities = *NO
>o   Password = *NONE

I was told that profiles with these attributes needed to be modified 
because
it was a security risk.  Some of the profiles mention were:
QAUTPROF
QBRMS
QCOLSRV
QDBSHR
QDBSHRDO
QDFTOWN
QDLFM
QDOC
QDSNX
QEJB
QFNC
QGATE
QLPAUTO
QLPINSTALL
QMSF
QNETSPLF
QNFSANON
QPGMR
QPM400
QRJE
QSECOFR
QSNADS
QSPL
QSPLJOB
QSRV
QSRVBAS
QSVCDRCTR
QSYS
QSYSOPR
QTCP
QTFTP
QTMHHTP1
QTMHHTTP
QTMPLPD
QTMTWSG
QTSTRQS
QUMB


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---