RE: Securing an outq

[qsrvbas@xxxxxxxxxxxx (Tom Liotta)]

midrange-l-request@xxxxxxxxxxxx wrote:

>   3. Re: Securing an outq (Vern Hamberg)
>
>Look in the archives for SPLCTL and JOBCTL. OUTQ security is a little 
>weird.

I'm not disagreeing, Vern, just making general comments...

I'm not sure I'd classify it as "weird" though it sure seems that there's major 
confusion out there about special authorities. (And I have my own confusions at 
times.)

Within the world of spooled files, *SPLCTL might as well be viewed the same as 
*ALLOBJ for most objects. By granting a "special authority", you're telling the 
system that it can ignore relevant authority checks and simply grant access. It 
doesn't matter what's been applied for authorizations; _this_ user is "special" 
and the normal authorizations are not to be applied.

Too many sites grant the blanket authority rather than maintaining only the 
needed authority. And also leave accounting turned off so nobody can tell what 
happened to the spooled file after it was created. And also leave auditing off 
so there's no trace. And also... ask how to tell what happened after the report 
is lost.

If all of this weren't so easy to do under Windows, there wouldn't be so much 
confusion under OS/400.

Tom Liotta

-- 
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertechgroup.com


__________________________________________________________________
McAfee VirusScan Online from the Netscape Network.
Comprehensive protection for your entire computer. Get your free trial today!
http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397

Get AOL Instant Messenger 5.1 free of charge.  Download Now!
http://aim.aol.com/aimnew/Aim/register.adp?promo=380455