RE: security hole in interactive sql call statement?

[Steve Martinson <Steve.Martinson@xxxxxxxxx>]

Lim,

QCMDEXC is not a traditional command where you can decide whether to allow
limited users access via ALWLMTUSR, which specifies whether the command can
be entered from the command line on a menu by a user whose profile is set
for limited capabilities, referencing LMTCPB keyword on the Create User
Profile (CRTUSRPRF) and Change User Profile (CHGUSRPRF) commands.

So, at a minimum, you can have a mitigating activity in place whereby you
change the object auditing value of the QCMDEXC program to *USRPRF and the
user auditing value of specific users you want to monitor *ALL, and then
regularly report on who has been accessing the program.  The combination of
the object and user auditing settings will write records for only those user
profiles that have auditing "turned on."  

Also, you could utilize an exit program for the SQL types of activities that
fully records the SQL transactions strings and that allows you to secure
remote (non green-screen) access to specific objects or commands referenced
within the SQL string.  You certainly can write your own program with the
help of some of the very knowledgeable folks on this forum.  Finally, some
third party exit program solutions give you that granularity and some just
memorize an entire transaction string in total, so you would need to decide
what's best for your environment.

Best regards,

Steven W. Martinson, CISSP, CISM
iSeries Security Consultant
NetIQ Corporation
Mobile:  281.546.9836

____________________________________________________________________________
__________ 

message: 9
date: Tue, 16 Nov 2004 08:32:32 -0600
from: "Lim Hock-Chai" <Lim.Hock-Chai@xxxxxxxx>
subject: security hole in interactive sql call statement?

We have a menu option that allow programmer to get into interactive sql
(STRSQL) on our production box.  Our production files are secured to only
allow view only access for programmers.  This work well with the exception
of the call statement.  
 
Here is the problem: 
Programmer user profile is set to Limit Capabilities *YES.  However, in
STRSQL, he/she can actually do this to exec a command: CALL
qcmdexc('WRKACTJOB',000000009.00000) or call any program.  
 
Is this a security hole on AS400? 
 
Is there a way to lock down call statement in STRSQL?

Best regards,

Steven W. Martinson, CISSP, CISM
iSeries Security Consultant
NetIQ Corporation
Mobile:  281.546.9836