Re: Locking out USRPRF with *ALLOBJ

Yes there is.  If you are running OS/400 V5R1 or greater, SST requires a user 
id and password that is not tied to the iSeries user profile.  Also, if this 
person has *SERVICE special authority, you may want to consider removing that 
special authority. 

You can also lock down your system values via SST as well if you are running 
OS/400 V5R1 or greater.  

Regards,

Mike Shaw 


> btw-It is possible to lock an *allobj out of Service Tools...
> jim
> ----- Original Message ----- 
> From: "Mike" <mshaw2456@xxxxxxxxxxx>
> To: "'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
> Sent: Tuesday, June 22, 2004 2:51 PM
> Subject: RE: Locking out USRPRF with *ALLOBJ
> 
> 
> > It looks to see if *ALLOBJ is present first when authority lookup is
> > performed.  If it does find *ALLOBJ, the authority lookup is done and is
> > allowed to do what is required.
> >
> > <hth>
> >
> > Mike Shaw
> >
> > -----Original Message-----
> > From: midrange-l-bounces@xxxxxxxxxxxx
> > [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> > michaelr_41@xxxxxxxxxxxxxx
> > Sent: Tuesday, June 22, 2004 11:41 AM
> > To: Midrange Systems Technical Discussion
> > Subject: RE: Locking out USRPRF with *ALLOBJ
> >
> > And the security checking model short circuits as soon as it finds
> > *ALLOBJ, which is checked before other authorities IIRC.
> >
> > On Tue, 22 Jun 2004 14:37:00 -0400, "Fisher, Don"
> > <Dfisher@xxxxxxxxxxxxxxxxx> said:
> > > The CHGUSRPRF help text for *ALLOBJ states:
> > > "All object authority is granted to this user.  This user has authority
> > > to
> > > all objects on the system."
> > >
> > > As I recall, this is definitive.  Any user with *ALLOBJ can do anything
> > > to
> > > any object regardless of any authority restrictions.
> > >
> > > Hope that helps.
> > >
> > > Donald R. Fisher, III
> > > Project Manager
> > > Roomstore Furniture Company
> > > (804) 784-7600 extension 2124
> > > DFisher@xxxxxxxxxxxxx
> > >
> > > <clip>
> > > Is there a way to lock a USRPRF that has ALLOBJ authority out of a
> > > specific
> > > library and/or command?
> > > <clip>
> > > --
> > > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > > list
> > > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at http://archive.midrange.com/midrange-l.
> > >
> > -- 
> >
> >   michaelr_41@xxxxxxxxxxxxxx
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> >
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
> >
> >
> 
> 
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>