Re: Securing an output queue

[Dean.Eshleman@xxxxxxxxxxxxxx]

John,

Thanks for the suggestion, I'll give it a try.

Dean


On Wed, 21 Apr 2010 14:18:08 -0700, in midrange.midrange-l you wrote:

> If the developers have either *JOBCTL or *SPLCTL, and the OPRCTL(*YES) 
> parameter is specified on the OUTQ, the developers will be able to use 
> and work with the OUTQ.  One way to correct this is to turn the OPRCTL 
> parameter on the OUTQ to *NO.
>
> Assuming programmers have *JOBCTL, here is what I would do....
>
> 1) Make the OUTQ *OPRCTL(*NO)
> 2) Create a Group Profile for all developers
> 3) Add the Group Profile to the OUTQ with an authority of *EXCLUDE
> 4) Give the authorized user Group(s) *CHANGE (authorized users could 
> be *PUBLIC now that the programmers are excluded.)
> 5) If there are any *JOBCTL or *SPLCTL users (SysOpers?) who you want 
> to be able to manage the OUTQ, give them *CHANGE authority as well.
>
> HTH,
>
> jte



On Apr 21, 2010, at 1:40 PM, Dean.Eshleman@xxxxxxxxxxxxxx wrote:

> Hi,
>
> I'm trying to secure a production output queue to keep developers from
> putting spool files in it and I'm struggling with how to do that. 
> Here
> are the current settings on the output queue:
>
> Display any file *NO
> Operator controlled *YES
> Authority to check *OWNER
>
> Object authority on the queue is as follows:
>
> *PUBLIC                                   *USE
> *GROUP      MYGROUP      *ALL
> QSPL                                         *CHANGE
> QSYSOPR                              *ALL
>
> I have read the help regarding these parameters and I'm not sure 
> what to
> change.  I'm thinking that I change Authority to check to *DTAAUT 
> and then
> add object authority for the various developer groups and set them to
> *USE.  I would probably need to change *PUBLIC to *CHANGE so that 
> they can
> add spool files to the queue.  Is this the correct approach?
>
> TIA
>
> Dean Eshleman,
> Software Development Architect
> Mennonite Mutual Aid, Inc.
> Phone: (574) 533-9511 x528
>
> ______________________________________________________________________
> Confidentiality Notice: This information is intended only for the 
> individual or entity named. If you are not the intended recipient, 
> do not use or disclose this information.  If you received this e- 
> mail in error, please delete or otherwise destroy it and contact us 
> at (800) 348-7468 so we can take steps to avoid such transmissions 
> errors in the future. Thank you.
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L)