RE: Locking out USRPRF with *ALLOBJ

[qsrvbas@xxxxxxxxxxxx (Tom Liotta)]

midrange-l-request@xxxxxxxxxxxx wrote:

>   6. Locking out USRPRF with *ALLOBJ (Bill Freiberg)
>
>Is there a way to lock a USRPRF that has ALLOBJ authority out of a specific
>library and/or command?
>
>I have changed the objects I want to protect from this specific usrprf to
>*EXCLUDE any authority to the profile, but the profile can still access the
>command and library.

Bill:

Easiest way I can think of:

 ==> chgusrprf  allobjusr password(*NONE) status(*DISABLED)

and maybe throw in inlpgm(*NONE) inlmnu(*SIGNOFF) for good measure.

To be honest, even that might not be sufficient unless you can guarantee all 
past actions have been fully audited and accounted for. (And I doubt that goes 
far enough.)

In general, you'll then have an *ALLOBJ user profile who can't access the 
commands or libraries... unless some other user profile has authority to use 
that profile to cause things to be done or... ?

There are other cruder hacks that are not secure and _NOT_ recommended but can 
be used in times of need in order to get past temporary obstacles, but the only 
reasonable solution is not to give *ALLOBJ to someone who shouldn't have access 
to _ALL OBJECTS_.

For example, you can put *ALLOBJ in a group profile, remove it from the user 
and then add the user to the group. Private *EXCLUDE authorities then take 
effect for the user. Of course, the user can use the group *ALLOBJ to take all 
kinds of routes around the restriction and even remove the restriction, but 
I've found it to be useful when keeping new people or trainees from shooting 
themselves in the foot. Sometimes crude methods are appropriate and aren't 
significantly worse than giving *ALLOBJ directly.

Only you know the circumstances you're in. I don't suppose you could describe 
the business case for granting *ALLOBJ while restricting specific object 
access? Maybe there's an appropriate technique for you.

Tom Liotta

-- 
Tom Liotta
The PowerTech Group, Inc.
19426 68th Avenue South
Kent, WA 98032
Phone  253-872-7788 x313
Fax    253-872-7904
http://www.powertech.com


__________________________________________________________________
Switch to the New Netscape Internet Service.
As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register

Netscape. Just the Net You Need. 

New! Netscape Toolbar for Internet Explorer
Search from anywhere on the Web and block those annoying pop-ups.
Download now at http://channels.netscape.com/ns/search/install.jsp