Re: Setup "locked down" RPG CGI environments on IBM i

Aaron

If you want to restrict a user to starting only a certain Apache instance, maybe block out STRTCPSVR and ENDTCPSVR and create equivalent commands defaulting to running those commands with the instance pre-set. These would need to have adopted authority to run the *TCPSVR commands. These users could also be restricted to just their resources - timeshare boxes do something like this, I imagine - I know the one I'm one does not let me see other developers' stuff.

And the Apache config gives you limits according to the various directives for directories, right?

Is that anywhere close to addressing your question? If so or not - back to work!! :-)

Vern

Aaron Bartell wrote:

I am hoping this is the right forum to ask this in because it mostly has to
do with system setup.

This post is concerning a new thread I started on the YiPs forum this
morning which can be viewed at the following location:
http://174.79.32.155/forum/viewtopic.php?f=7&t=182&sid=0482f50a14bf2305053373ee2cdb5c9d#p865

Basically I am in need of some insight on how best to setup locked down
environments for RPG CGI development. I need to give RPG developers enough
access to accomplish a tutorial but not allow them to touch anybody elses
stuff (i.e. jobs, libraries, spool files, etc).

Has anybody setup such an environment and would you be willing to share your
thoughts and ideas? and maybe even code that helped with things like
starting and stopping Apache servers in a locked down nature. For example,
users could use ENDTCPSVR directly but they could call a custom command like
the following: ENDHTTPSVR SVR(RPGUI001)

Aaron Bartell
http://mowyourlawn.com
http://mowyourlawn.com/blog/