Re: QMAXSGNACN

I prefer disable profile only. I've had too many occasions were the console got varied off while at restricted state.

Remember that even if QSECOFR is disabled it can still signon at the console.

Bryan



On Mar 23, 2011 1:13pm, rob@xxxxxxxxx wrote:

We had "yet another security audit". This time we are getting dinged

because we have QMAXSGNACN sent to 1=Disable device. It is recommended

that we use 3=Disable device and profile. Their concern is that someone

could mount a Denial Of Service attack on us and disable all of our

virtual devices. My thought is, that if I set it to disable user profiles

wouldn't that just expand the DOS attack to include user profiles also?

Let's see, sign on 3 times and disable QSECOFR, then try QSYSOPR and

several others. Granted, you could use this to recover QSECOFR (which is

quite drastic)

http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzamh/rzamhrecover.htm

or you could sign on as someone else with that level of authority and

reset it there.

Anyone with command line access can do a

wrkobj qusrsys/*all *msgq

and get a list of all your user profiles. I just signed on as this user

crtusrprf dummy

and was able to perform that. (Please do not take offense at the user

name - it's just a habit of mine. The operator knows to kill it on

sight.)

Rob Berendt

--

Group Dekko

Dept 1600

Mail to: 2505 Dekko Drive

Garrett, IN 46738

Ship to: Dock 108

6928N 400E

Kendallville, IN 46755

http://www.dekko.com

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.