RE: Moving from Security Level 20 to Security Level 30

Booth,

Don't do it - moving to QSECURITY level 30 is a waste of time. Go right
to 40, you'll have minimum extra effort and gain a bunch in operating
system integrity.

There are less than 2 pages instruction on how to get from 30 to 40 in
the Security Reference guide. When I have helped customers do it has
been less than 2 days effort - and usually a relaxed two days at that.

Moving off of QSECURITY level 20 is more complicated. Essentially the
only difference between 20 and 30 is that every time you create a new ID
on a level 20 box it automatically gets *ALLOBJ. I don't much like the
IBM instructions on how to get from 20 to 30 because they are too long
and complex. My experience is that most users on a level 20 machine
will work just fine at 30 or 40, and the best way to test that is to
pick a hand full of users and remove their *ALLOBJ authority and watch
them for a few days. If they don't have any problems, then move to the
next group. I would recommend doing this a department at a time. If a
user has difficulty, you can either give them private authority to
something, or temporarily give them *ALLOBJ again while you work out the
problem.

20 - 40 will take a bit longer than 30 - 40, but is still very doable -
and worth doing. If you need additional help, don't hesitate to call.

jte


--
John Earl
The PowerTech Group, Inc.
Direct: 253-479-1408
Mobile: 206-669-3336

www.powertech.com

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Booth Martin
Sent: Monday, May 04, 2009 2:13 PM
To: Midrange Systems Technical Discussion
Subject: Moving from Security Level 20 to Security Level 30

We are considering moving from security level 20 to security
level 30.
This is an old system, dating from sys/36 days, running on a
v4r25 box.
So far I can't see any serious gotcha's, but my experience
tells me that asking the questions ahead of time is a useful idea.

Are there gotchas that you can think of that we need to be
looking for?


--
---------------------------------
Booth Martin
http://www.Martinvt.com
---------------------------------

--
This is the Midrange Systems Technical Discussion
(MIDRANGE-L) mailing list To post a message email:
MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change
list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting,
please take a moment to review the archives at
http://archive.midrange.com/midrange-l.

_______________

Confidentiality Notice: This e-mail, including attachments, may include confidential and/or proprietary information, and may be used only by the person or entity to which it is addressed. If the reader of this e-mail is not the intended recipient or his or her authorized agent, the reader is hereby notified that any dissemination, distribution or copying of this e-mail is prohibited. If you have received this e-mail in error, please notify the sender by replying to this message and delete this e-mail immediately.

________________