RE: Recent bugtraq postings

I am curious what the "whatever" is.  Because it sure isn't just *ALLOBJ 
or group rights.  Like should ROBB13 be able to see ROB on WRKUSRPRF *ALL?

DSPUSRPRF ROBB13
Special authority  . . . . . . . . . . . . :   *NONE
Group profile  . . . . . . . . . . . . . . :   SSA13 
Owner  . . . . . . . . . . . . . . . . . . :   *GRPPRF 
Group authority  . . . . . . . . . . . . . :   *NONE 
Group authority type . . . . . . . . . . . :   *PRIVATE
Supplemental groups  . . . . . . . . . . . :   DEVELOP 

DSPUSRPRF SSA13
Special authority  . . . . . . . . . . . . :   *JOBCTL 
Group profile  . . . . . . . . . . . . . . :   *NONE 
Owner  . . . . . . . . . . . . . . . . . . :   *USRPRF 
Group authority  . . . . . . . . . . . . . :   *NONE 
Group authority type . . . . . . . . . . . :   *PRIVATE
Supplemental groups  . . . . . . . . . . . :   *NONE 

DSPUSRPRF DEVELOP
Special authority  . . . . . . . . . . . . :   *JOBCTL 
                                               *SAVSYS 
Group profile  . . . . . . . . . . . . . . :   *NONE 
Owner  . . . . . . . . . . . . . . . . . . :   *USRPRF 
Group authority  . . . . . . . . . . . . . :   *NONE 
Group authority type . . . . . . . . . . . :   *PRIVATE
Supplemental groups  . . . . . . . . . . . :   *NONE 

DSPOBJAUT ROB *USRPRF
                         Object    ----------Object-----------
User        Group       Authority  Opr  Mgt  Exist  Alter  Ref
*PUBLIC                 USER DEF 
QSECOFR                 *ALL        X    X     X      X     X 
ROB                     USER DEF    X    X 
          ---------------Data---------------
User      Read  Add  Update  Delete  Execute
*PUBLIC          X             X 
QSECOFR    X     X     X       X        X 
ROB        X     X     X       X        X 

Ah-hah!  That's it!  Now if I can only figure out why it is that way.  Or, 
do I just set *public to *exclude and worry about the ramifications later?

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"John Earl" <john.earl@xxxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
04/22/2005 02:06 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: Recent bugtraq postings






> if you don't
> have Godlike authorities and you try the LDAP "exploit",
> do you still
> get a list of all users?

If you are authorized to read (*USE) a user profile, or you belong to
the same group profile as another user, then the LDAP directory will
display the user name to you. 

But... if you have *USE rights to someone's user profile (whether
because of *ALLOBJ, or Group rights, or whatever), then there are any
number of methods by which you can see the user profile (DSPOBJD,
WRKUSRPRF, IFS links, etc.), so I don't see how this is an "LDAP"
problem. 

And if you have the ability to *USE a profile, you also have the ability
to assume the identity of that profile - which is potentially a HUGE
security problem, but it's a "security configuration" problem and not a
failing of the underlying facilities.

IMHO,

jte


--
John Earl | Chief Technology Officer
The PowerTech Group
19426 68th Ave. S
Seattle, WA 98032
(253) 872-7788 ext. 302
john.earl@xxxxxxxxxxxxx
www.powertech.com 
 

 
This email message and any attachments are intended only for the use of
the intended recipients and may contain information that is privileged
and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message, or by telephone, and delete
the message from your email system.
--

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx [mailto:midrange-l-
> bounces@xxxxxxxxxxxx] On Behalf Of Joe Pluta
> Sent: Friday, April 22, 2005 9:00 AM
> To: 'Midrange Systems Technical Discussion'
> Subject: RE: Recent bugtraq postings
> 
> True (although the older I've gotten the more reticent I
> am to accept
> such authority -- it's plausible deniability <grin>).  But
> if you don't
> have Godlike authorities and you try the LDAP "exploit",
> do you still
> get a list of all users?
> 
> Joe
> 
> > From: rob@xxxxxxxxx
> >
> > Joe, you and I probably have Godlike authority on most
> of the machines
> we
> > work on.  Normal users execution of WRKUSRPRF tells them
> nasty things
> > about their mother.  Their workaround is to do a WRKOBJ
> QUSRSYS/*ALL
> > *MSGQ.
> 
> --
> This is the Midrange Systems Technical Discussion
> (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit:
> http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/midrange-l.


-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.