Re: Locking out USRPRF with *ALLOBJ

["Steve Landess" <sjl_123@xxxxxxxxxxx>]

> "Bill Freiberg" wrote:
> Subject: Locking out USRPRF with *ALLOBJ


> Is there a way to lock a USRPRF that has ALLOBJ authority out of a
specific
> library and/or command?
>
> I have changed the objects I want to protect from this specific usrprf to
> *EXCLUDE any authority to the profile, but the profile can still access
the
> command and library.


Bill -

<Rant>
Yes, you can (kind of):
BY TAKING *ALLOBJ AUTHORITY AWAY FROM THIS USER!
</Rant>

You probably haven't had an IT audit lately!

I can't think of a good reason for ANY user to have *ALLOBJ authority.
If it is because you never designed a good security scheme for securing
objects on your system, NOW is the time.

There are some very good security packages available for the iSeries
that help you to monitor and secure your system.  For example,
POWERLOCK by POWERTECH - and their top guys (John Earl
and Tom Liotta) are members of THIS list!

And I would guess that you have more than one user that has *ALLOBJ
authority...  ;)

Regards,
Steve Landess
Austin, Texas
(512) 423-0935