RE: Securing an outq

[Vern Hamberg <vhamberg@xxxxxxxxxxxxxxxxxxxxxxxxx>]

LOL, Tom. I meant "weird" as in not obvious, so people do as you describe 
and leave things wide open.

Vern

At 04:42 PM 6/23/2003 -0400, you wrote:
> midrange-l-request@xxxxxxxxxxxx wrote:
>
> >   3. Re: Securing an outq (Vern Hamberg)
> >
> >Look in the archives for SPLCTL and JOBCTL. OUTQ security is a little
> >weird.
>
> I'm not disagreeing, Vern, just making general comments...
>
> I'm not sure I'd classify it as "weird" though it sure seems that there's 
> major confusion out there about special authorities. (And I have my own 
> confusions at times.)
>
> Within the world of spooled files, *SPLCTL might as well be viewed the 
> same as *ALLOBJ for most objects. By granting a "special authority", 
> you're telling the system that it can ignore relevant authority checks and 
> simply grant access. It doesn't matter what's been applied for 
> authorizations; _this_ user is "special" and the normal authorizations are 
> not to be applied.
>
> Too many sites grant the blanket authority rather than maintaining only 
> the needed authority. And also leave accounting turned off so nobody can 
> tell what happened to the spooled file after it was created. And also 
> leave auditing off so there's no trace. And also... ask how to tell what 
> happened after the report is lost.
>
> If all of this weren't so easy to do under Windows, there wouldn't be so 
> much confusion under OS/400.
>
> Tom Liotta