Re: *SECADM change QSECOFR password?

["Jim Franz" <franz400@xxxxxxxxxxxx>]

it is the *allobj in the ukhelp that causes the prob. Allobj includes
the object qsecofr *usrprf.
If they need special powers, put it in a pgm that adopts auth, but
suggest they should not have allobj. (do be careful with adopt auth).
jim

----- Original Message -----
From: <D.BALE@handleman.com>
To: <MIDRANGE-L@midrange.com>
Sent: Friday, April 20, 2001 2:56 PM
Subject: *SECADM change QSECOFR password?


> We set up a user profile (UKHELP) at one of our international branches
whose
> sole purpose is to reset passwords and re-enable profiles for profiles
that
> got disabled due to too many invalid attempts to sign on.
>
> This works fine except that this user profile has the ability to change
the
> QSECOFR profile as well.  How can we prevent that?  Following are
pertinent
> bits & pieces from the UKHELP profile:
>   User class . . . . . . . . :   *SECADM
>   Special authority  . . . . :   *SECADM
>   Group profile  . . . . . . :   SECADM
>   Owner  . . . . . . . . . . :   *USRPRF
>   Group authority  . . . . . :   *NONE
>   Group authority type . . . :   *PRIVATE
>   Supplemental groups  . . . :   *NONE
>   Initial program  . . . . . :   SEC612R
>     Library  . . . . . . . . :     *LIBL
>   Initial menu . . . . . . . :   MAIN
>     Library  . . . . . . . . :     *LIBL
>   Limit capabilities . . . . :   *NO
>
> Following are pertinent bits & pieces from the QSECOFR profile:
>   User class . . . . . . . . :   *SECOFR
>   Special authority  . . . . :   *ALLOBJ
>                                  *AUDIT
>                                  *IOSYSCFG
>                                  *JOBCTL
>                                  *SAVSYS
>                                  *SECADM
>                                  *SERVICE
>                                  *SPLCTL
>   Group profile  . . . . . . :   *NONE
>   Owner  . . . . . . . . . . :   *USRPRF
>   Group authority  . . . . . :   *NONE
>   Group authority type . . . :   *PRIVATE
>   Supplemental groups  . . . :   *NONE
>   Initial program  . . . . . :   *NONE
>     Library  . . . . . . . . :
>   Initial menu . . . . . . . :   MAIN
>     Library  . . . . . . . . :     *LIBL
>   Limit capabilities . . . . :   *NO
>
> FWIW, DSPPGM SEC612R (UKHELP's initial program) shows "Use adopted
authority:
> = *YES"
>
> TIA!
>
> - Dan
> Dan Bale says "Ban Dale!"
> IT - AS/400
> Handleman Company
> 248-362-4400  Ext. 4952
> D.Bale@Handleman.com
>   Quiquid latine dictum sit altum viditur.
>   (Whatever is said in Latin seems profound.)
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to
MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator:
david@midrange.com
> +---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---