RE: Security Question

Pat,

I had an interesting problem the other day and I was
wondering how long this has been in place.

It was V3R7 where IBM made a couple of key changes to the execution of
the PWRDWNSYS command...
A) You must have *JOBCTL special authority to run the command
B) *PUBLIC's authority to the PWRDWNSYS command was change from *CHANGE
to *EXCLUDE.

In order for your user to run the PWRDWNSYS command, he'll need *JOBCTL
and specific authority to the PWRDWNSYS command.

jte

--
Interested in attending the ONLY conference focused on System i security
and compliance? Check out iNSIGHT 2008, Feb 11-13, 2008 in Las Vegas.
Click here to learn more.

John Earl, VP and Chief Technology Officer
PowerTech: 253-872-7788
Direct: 253-479-1408
Mobile: 206-669-3336
John.Earl@xxxxxxxxxxxxx




Email is an excellent way to communicate material that is not time
sensitive. If your communication is of a more urgent nature, please
call.

===========================
This email message and any attachments are intended only for the use of
the intended recipient named above and may contain information that is
privileged and confidential. If you are not the intended recipient, any
dissemination, distribution, or copying is strictly prohibited. If you
received this email message in error, please immediately notify the
sender by replying to this email message or by telephone and delete the
message from your email system. Thank you.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Pat Barber
Sent: Tuesday, January 08, 2008 12:29 PM
To: Midrange Systems Technical Discussion
Subject: Security Question

I had an interesting problem the other day and I was
wondering how long this has been in place.

I told an system operator to power down the box and do a restart.
He is enrolled as *sysopr. He could not.

He does not have the authority to even see the power menu ???

He could not execute the pwrdwnsys command ???

This is on a 525 running V5R4.

The authorties for that cmd are *USE for QSYSOPR

I will grant you we don't power down very often, but I would
like the operator to be able to do that if neccessary.
--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L) mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting,
please take a moment to review the archives at
http://archive.midrange.com/midrange-l.