Re: QAUDJRN

[Patrick Botz <botz@xxxxxxxxxx>]

Dave,

You can also prevent  *ALLOBJ/security officers from being able to change
security related system values.  In V5R2, as long as you control the
service tools userIDs and the privileges that the other folks have, you can
lock down security related system values using SST.  You would also want to
prevent service tools userIDs with a default password from being
changed/logged into (another option in the service tools security menu).
Doing so will prevent any *ALLOBJ user profile from being able to change
your security related system values.  It also prevents 3rd party
applications from changing them "under the covers" during an
install/upgrade.

By using this AND using the audit journal, you can prevent others from
changing security related system values and also track who is changing
other non-security related system values.

Patrick Botz
Senior Technical Staff Member
Rochester CTC, eServer Security Architecture & Consulting
iSeries Security Architect
(507) 253-0917, T/L 553-0917
CTC Fax # 507-253-2070
email: botz@xxxxxxxxxx

For more information on CTC, visit our website at
http://www.ibm.com/eserver/services
http://www.ibm.com/servers/eserver/services


midrange-l-bounces@xxxxxxxxxxxx wrote on 11/15/2005 10:40:02 AM:

> During the last few weeks, I have had 2 TCP/IP parameters and 1
> SYSVAL changed without my knowledge.  There are a few people that
> have security officer authority and that cannot be changed.
>
> By using QAUDJRN, is it possible to track the changes?  How?  If
> not, what is available in the operationg system to track the
> changes. I am on V5R2.