Re: Not a security person but.

[rob@xxxxxxxxx]

You left me a little confused:
EXODUS had *ALLOBJ and had *IOSYSCFG and initial menu of *SIGNOFF.
Then you changed EXODUS, with your special id, and gave them a password 
and removed their initial menu of *SIGNOFF.
This person was able to sign on and change what?  You said they gave 
themselves *IOSYSCFG.  However, by your writing, it looks like they 
already had it.

Rob Berendt
-- 
"They that can give up essential liberty to obtain a little temporary 
safety deserve neither liberty nor safety." 
Benjamin Franklin 




"Bill Hopkins" <BHopkins@xxxxxxxxxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
11/14/2003 10:48 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
MIDRANGE-L@xxxxxxxxxxxx
cc

Subject
Not a security person but.






This is what I was able to do:

My profile 
*SECOFR 
*ALLOBJ 
*JOBCTL 
*SECADM 
*SERVICE
*SPLCTL 
has init pgm and menu.

EXODUS server profile
*ALLOBJ 
*IOSYSCFG 
has *signoff

I changed EXODUS to have new password the changed to 
have init pgm and menu. I then signon as EXODUS and changed my profile 
to have *IOSYSCFG special authority. Signed back on and started my own 
server.

What should I suggest to the Ops Manager to correct this work around? 
Besides just changing my profile :) Others are out there like this( mainly 

contractors ) and I'm 
afraid they might come back after they leave. Should I voice my concern or 

is there one.
Client did know of my actions so I wasn't doing this in the dark just 
showing it to him. But my knowledge is limited in 
this side of things what direction should he go.

Thanks 
Bill Hopkins
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.