Re: Command Line acess

Yes, but it's not an easy answer.
ASSUMEing that all your command line access is from calls to but a few 
api's:  QCAPCMD, QCMD, QUSCMDLN, system(), etc you could write a command 
exit point program to process the CALL command.  Check for a CALL to any 
of these and go from there.  Should do a dandy job of killing the 
performance of the CALL command on your system.  Then again, maybe the 
CALL command is not what's used when you issue a call in RPGLE so that 
goes down the tubes also.  Some people will tell you to put LMTCPB(*YES) 
on all users that have *ALLOBJ.  Most of the calls to the above programs 
ignore it and there are numerous packages out there that use a custom menu 
program which ignores the LMTCPB(*YES).  I've actually see vendors issue 
code that has a one line CL program, owned by QSECOFR of course, that's 
called by a menu and does nothing but CALL QCMDEXC.

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"John Candidi" <jacandidi@xxxxxxxxxxxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
05/18/2005 10:37 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
<midrange-l@xxxxxxxxxxxx>
cc

Subject
Command Line acess






Easy question, Is there a way to prevent users form getting a command line 
who have *ALLOBJ authority. 
 
John A Candidi 
IT Director/AS400 Manager
Rutgers Insurance Companies
Phone (856) 779-2274
Fax   (856) 799-0719

-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.