RE: iSeries FTP security

[rob@xxxxxxxxx]

Scott,

I respectfully disagree.

A bulk of 400 shops do not granualize their security enough.  For example, 
they use some sort of group profile to allow users to get into the 
'accounting' data library.  Once in there they hope that 5250 menu 
security works.  Now comes along a ftp project request.

One alternative might have been to change all their 5250 programs to 
USEADPAUT(*YES) and have some early program owned in the call stack to be 
owned appropriately and then also allow read access to individual users of 
the one file to download.

Another alternative is to leave the bulk of the security model the same, 
but use an ftp exit point program to only allow from one member in one 
file:
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr

But by canonization you could do
/qsys.lib/mylib.lib/myfile.file/mymbr.mbr/../../payroll.file/payroll.mbr
and get to what you need.  Because, if the exit point followed my poor 
technique of just checking the left to match with what they are authorized 
to - they're toast.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Ingvaldson, Scott" <SIngvaldson@xxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
05/16/2005 02:14 PM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
<midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: iSeries FTP security






That's just our old buddy Shalom with more FUD...

"Because the built-in FTP server provides full access to the IFS, a
valid, authenticated user, can access and retrieve via FTP all of the
database tables and all of the files that he has authority to access,
based on the server assigned object authority."

Emphasis on valid, authenticated user.

Regards,
 
Scott Ingvaldson
iSeries System Administrator
GuideOne Insurance Group 

-----Original Message-----
date: Mon, 16 May 2005 14:45:11 -0400
from: Neil Palmer/DPS <neilp@xxxxxxxxxxx>
subject: iSeries FTP security

FYI

http://www.exploits.co.in/Article909.html

...Neil

-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.