Re: Restriction on Database file object -- MIDRANGE-L

First, get and read and study (and read and study again) "Tips and Tools for Securing Your iSeries" - v5r2 version is at <http://publib.boulder.ibm.com/iseries/v5r2/ic2924/books/c4153006.pdf>. It is a great start - puts the concepts together in one place.

One basic approach is to use a part of what is called menu-controlled security. It involves concepts like adopted authority and USRPRF(*OWNER) attribute of programs and service programs.

Basically, data files are owned by a profile that cannot sign on.

PUBLIC *EXCLUDE is applied to all data files.

The CL program is owned by that same profile, which has all rights to the files.

Users that need the program are given *USE rights to the program.

And any programs called by this program should be changed to use adopted authority.

This is discussed in Chapter 6 of the above-mentioned book.

There are more things that can be done. See the above-mentioned book and the Security manuals.

Hope I remembered correctly - others will let you (and me <g>) know.

At 04:55 PM 7/30/2003 +0530, you wrote:

Hello Group,

We would like to impose the following restrictions end-users group profiles
with respect to Database files.The end users should not
be able to Delete a file object, but the programs that they call from the
menu(RPG) should be able to read,write,update and delete records.Also
CRTDUPOBJ and CPYF commands coded inside the CL program should work.

Could you please tell me what is the auth parameter that i should use in
GRTOBJAUT ?Making it *USE, *CHANGE, i found that CRTDUPOBJ command failed.Is
there any other work around?


Thanks and regards
Chandra Sekhar

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.