Re: *SECADM change QSECOFR password?

Write a program that adapts the authority of this UKHELP profile, but do not let
people signon to this UKHELP or let them have it as their group profile.  Then
only give authority to execute the program to those individuals you wish to be
able to reset passwords.  Then inside the program, you can control what users-id
do or do not get set.  You can do it by User Class, by Userid, by anything.  Its
much better than giving out *SECADM to a general group of people to do what they
wish.

    JMHO

        Pete Massiello

D.BALE@handleman.com wrote:

> We set up a user profile (UKHELP) at one of our international branches whose
> sole purpose is to reset passwords and re-enable profiles for profiles that
> got disabled due to too many invalid attempts to sign on.
>
> This works fine except that this user profile has the ability to change the
> QSECOFR profile as well.  How can we prevent that?  Following are pertinent
> bits & pieces from the UKHELP profile:
>   User class . . . . . . . . :   *SECADM
>   Special authority  . . . . :   *SECADM
>   Group profile  . . . . . . :   SECADM
>   Owner  . . . . . . . . . . :   *USRPRF
>   Group authority  . . . . . :   *NONE
>   Group authority type . . . :   *PRIVATE
>   Supplemental groups  . . . :   *NONE
>   Initial program  . . . . . :   SEC612R
>     Library  . . . . . . . . :     *LIBL
>   Initial menu . . . . . . . :   MAIN
>     Library  . . . . . . . . :     *LIBL
>   Limit capabilities . . . . :   *NO
>
> Following are pertinent bits & pieces from the QSECOFR profile:
>   User class . . . . . . . . :   *SECOFR
>   Special authority  . . . . :   *ALLOBJ
>                                  *AUDIT
>                                  *IOSYSCFG
>                                  *JOBCTL
>                                  *SAVSYS
>                                  *SECADM
>                                  *SERVICE
>                                  *SPLCTL
>   Group profile  . . . . . . :   *NONE
>   Owner  . . . . . . . . . . :   *USRPRF
>   Group authority  . . . . . :   *NONE
>   Group authority type . . . :   *PRIVATE
>   Supplemental groups  . . . :   *NONE
>   Initial program  . . . . . :   *NONE
>     Library  . . . . . . . . :
>   Initial menu . . . . . . . :   MAIN
>     Library  . . . . . . . . :     *LIBL
>   Limit capabilities . . . . :   *NO
>
> FWIW, DSPPGM SEC612R (UKHELP's initial program) shows "Use adopted authority:
> = *YES"
>
> TIA!
>
> - Dan
> Dan Bale says "Ban Dale!"
> IT - AS/400
> Handleman Company
> 248-362-4400  Ext. 4952
> D.Bale@Handleman.com
>   Quiquid latine dictum sit altum viditur.
>   (Whatever is said in Latin seems profound.)
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---

--
Pete Massiello
OS Solutions International
Phone: (203)-744-7854  Ext 11.
http://www.os-solutions.com
mailto:pmassiello@os-solutions.com


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---