Re: QMAXSGNACN

[jmmckee <jmmckee@xxxxxxxxxxxxxx>]

I worked at a State agency some years ago where the action was to disable profile and device.  What a pain that was.  Besides, it could be a self-inflicted DOS attack, if device is disable and profile is not.  So much simpler to only disable the profile.  Still secure.  

John McKee
  
-----Original message-----
From: rob@xxxxxxxxx
Date: Wed, 23 Mar 2011 12:50:49 -0500
To: Midrange Systems Technical Discussion midrange-l@xxxxxxxxxxxx
Subject: Re: QMAXSGNACN

> Interesting.  I'll keep that in mind about QSECOFR being able to use the 
> system console even when disabled.  Does it bark at you and warn you? 
> There's so much that depends on QSECOFR not being disabled that I would 
> like to know it is disabled.
> > From the console:
> chgusrprf qsecofr status(*disabled) 
> SIGNOFF
> Signed on as QSECOFR.
> DSPMSG QSYSOPR.  Nothing.
> DSPMSG QSECOFR.  Nothing.
> DSPLOG PERIOD((1335)).  Nothing.
> DSPJOBLOG.  Nothing.
> > From another session:
> CPF1394 User profile QSECOFR cannot sign on. 
> Back at console
> chgusrprf qsecofr status(*enabled)
> User profile QSECOFR changed. 
> Granted, if it was disable via QMAXSGNACN there would be one message in 
> QSYSOPR.
> My concern is that a coworker could assist me with one of my downtime 
> weekends, disable QSECOFR and I not know it.  Then stuff stops working and 
> I waste time trying to figure if it was some new ptf or some such thing.
>
> Right now, if the device is disabled after 3 tries, and the device happens 
> to be one of our wireless scanners, then Message Labs will vary the device 
> back on for 5 tries.  Effectively raising QMAXSIGN for just those devices 
> to 15 (3 x 5).  I could work with that.
>
> I still do not like them being able to disable ROB, PEGGY, CHRIS and a 
> host of others so easily though.
>
>
> Rob Berendt
> -- 
> Group Dekko
> Dept 1600
> Mail to:  2505 Dekko Drive
>           Garrett, IN 46738
> Ship to:  Dock 108
>           6928N 400E
>           Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> From:   bdietz400@xxxxxxxxx
> To:     Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
> Date:   03/23/2011 01:26 PM
> Subject:        Re: QMAXSGNACN
> Sent by:        midrange-l-bounces@xxxxxxxxxxxx
>
>
>
> I prefer disable profile only. I've had too many occasions were the 
> console 
> got varied off while at restricted state.
>
> Remember that even if QSECOFR is disabled it can still signon at the 
> console.
>
> Bryan
>
>
>
> On Mar 23, 2011 1:13pm, rob@xxxxxxxxx wrote:
> > We had "yet another security audit". This time we are getting dinged
>
> > because we have QMAXSGNACN sent to 1=Disable device. It is recommended
>
> > that we use 3=Disable device and profile. Their concern is that someone
>
> > could mount a Denial Of Service attack on us and disable all of our
>
> > virtual devices. My thought is, that if I set it to disable user 
> profiles
>
> > wouldn't that just expand the DOS attack to include user profiles also?
>
> > Let's see, sign on 3 times and disable QSECOFR, then try QSYSOPR and
>
> > several others. Granted, you could use this to recover QSECOFR (which is
>
> > quite drastic)
>
> >
> http://publib.boulder.ibm.com/infocenter/iseries/v6r1m0/topic/rzamh/rzamhrecover.htm
>
>
> > or you could sign on as someone else with that level of authority and
>
> > reset it there.
>
>
>
> > Anyone with command line access can do a
>
> > wrkobj qusrsys/*all *msgq
>
> > and get a list of all your user profiles. I just signed on as this user
>
> > crtusrprf dummy
>
> > and was able to perform that. (Please do not take offense at the user
>
> > name - it's just a habit of mine. The operator knows to kill it on
>
> > sight.)
>
>
>
> > Rob Berendt
>
> > --
>
> > Group Dekko
>
> > Dept 1600
>
> > Mail to: 2505 Dekko Drive
>
> > Garrett, IN 46738
>
> > Ship to: Dock 108
>
> > 6928N 400E
>
> > Kendallville, IN 46755
>
> > http://www.dekko.com
>
>
>
> > --
>
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> > list
>
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
>
> > To subscribe, unsubscribe, or change list options,
>
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
>
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
>
> > Before posting, please take a moment to review the archives
>
> > at http://archive.midrange.com/midrange-l.
>
>
>
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> -- 
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.