Re: Security and IFS

They are all under one root folder. But I believe my question was answered
here. We are joining our Payroll system and Accounting system to system.
(different packages). So Now I have to rush to figure out how to lock some
stuff down. This will make my job easier. Thanks!

On 2/6/06, Scott Klement <midrange-l@xxxxxxxxxxxxxxxx> wrote:
>
> > However, my question is this. If I change the security on the root
> > folder, can a user who doesn't have authority get to anything futher
> down
> > the tree?
>
> You need *X authority to all of the previous directories in the pathname
> in order to open an file through the IFS interface.
>
> Some areas of the IFS (/QSYS.LIB, /QDLS, /QNTC, etc) can be accessed
> through other interfaces besides the IFS interface. I don't know if the
> same security restrictions will work when using a non-IFS interface.
>
> At any rate, I wouldn't deny users *X access to the actual root folder of
> the IFS, because all sorts of nasty things are likely to happen (such as
> QSTRUP crashing and therefore stopping an IPL from completing). Instead,
> move your 550 folders so that they're all in one common subfolder, then
> deny access to that.
>
> In other words, instead of
>
> /folder1
> /folder2
> /folder3
>
> have
>
> /mydocs/folder1
> /mydocs/folder2
> /mydocs/folder3
>
> Then you can deny access to /mydocs to lock everything down, and there's
> no need to change the permissions on the root folder.
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>


--
Mike Wills
koldark@xxxxxxxxx
http://mikewills.name
http://theriverbendpodcast.com

"There are 10 types of people in the world: those who understand binary, and
those who don't." -Unknown