RE: Special Authority *SERVICE

[daparnin@xxxxxxxxxxxxxx]

This person should not be debugging programs.  I'm the one who would do
that or possibly my boss, and he would probably ask me to do it.  This
person works with EDI.  Eric's previous message said that it could be used
for a communications trace but that would still be stretching things quite
a bit for this person's job function.


Dave Parnin
Nishikawa Standard Company
Topeka, IN  46571
daparnin@xxxxxxxxxxxxxx




                                                                                
                                 
                      rob@xxxxxxxxx                                             
                                 
                      Sent by:                    To:       Midrange Systems 
Technical Discussion                
                      midrange-l-bounces@m         <midrange-l@xxxxxxxxxxxx>    
                                 
                      idrange.com                 cc:                           
                                 
                                                  Subject:  RE: Special 
Authority *SERVICE                       
                                                                                
                                 
                      04/29/2005 02:41 PM                                       
                                 
                      Please respond to                                         
                                 
                      Midrange Systems                                          
                                 
                      Technical Discussion                                      
                                 
                                                                                
                                 




Half of those commands were commands commonly used in debugging a program.
 Hopefully that level of access is no longer needed (it was a V4R3 source,
right?).

I wonder if a clue would be anything with QSRV listed as having access
DSPOBJAUT OBJ(STRSST) OBJTYPE(*CMD)

There is a WRKOBJOWN command but I don't see a WRKOBJUSR command.

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Eric Graeb" <egraeb@xxxxxxxxxxxxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
04/29/2005 02:00 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
"'Midrange Systems Technical Discussion'" <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: Special Authority *SERVICE






Did a search on IBM and found these:

"OS/400 CL Reference V4R3"
9 topics have matches for: SERVICE special authority
CHKCMNTRC (Check Communications Trace) Command, 3.1.341
ADDPGM (Add Program) Command, 3.1.61
CHGHLLPTR (Change High-Level Language Pointer) Command, 3.1.206
CHGPGMVAR (Change Program Variable) Command, 3.1.278
CHGPTR (Change Pointer) Command, 3.1.288
DSPPGMVAR (Display Program Variable) Command, 3.1.760
STRSST (Start System Service Tools) Command, 3.1.1265
PRTUSRPRF (Print User Profile) Command, 3.1.957
STRDBG (Start Debug) Command, 3.1.1218

Hope this helps.


-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
daparnin@xxxxxxxxxxxxxx
Sent: Friday, April 29, 2005 1:21 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Special Authority *SERVICE





I happened to notice that the security of a person who used to be in the
I.T. department still has the special authority of *SERVICE.  My hunch is
that they don't need this anymore.  What actually does this give them?
Access to SST?  Both the help text and Infocenter say "Service authority
is
granted to this user.  The user can perform service functions."  That's
like saying my cat can walk on four legs because he has four legs.  I
didn't find anything in the archives.  Thanks.



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.