In regards to managing security objects you may want to take a look at PowerTech.
Security management on the AS400 is a bit of a black hole, one of the critical issues with it is that they grant *PUBLIC object authority gets *CHANGE access to everything by default unless your system operators were smart at the initial installation of the system and changed the QCRTAUT system value to something other than *CHANGE. This in itself is a huge security nightmare to overcome if this was not thought about though when the system was put in place (which is what most IBM shops run into when they really dig into security).
This is a really good article on the security issues that the IBM i faces:
http://www.iprodeveloper.com/content1/print?topic=db2-data-protection-options-and-essentials-62310&catpath=security&print=1
-----Original Message-----
From: brad.lovelady@xxxxxxxxxxxxxx [mailto:brad.lovelady@xxxxxxxxxxxxxx]
Sent: Friday, August 24, 2012 9:27 AM
To: midrange-l@xxxxxxxxxxxx
Subject: System i security management questions
All,
We have some consistency initiatives making the rounds therefore I would appreciate some opinions relative to following topics.
Anyone using LDAP/SSO to access their systems? If so do you have a favorable opinion of it?
I am also particularly interested in what software you all use help manage things like:
- Privilege management
- AUTLs
- Object security
- ID provisioning
Lastly, who handles System i security at your organization? (ie. System administrators, security team, etc)
***********************************
Bradford Lovelady
Operating Systems Engineer
Technology Infrastructure Services
Wells Fargo Bank l 200 Wildwood Pkwy l Birmingham, AL 35209 MAC W2691-010 Tel 205-938-1999 l Cell 205-826-2834
brad.lovelady@xxxxxxxxxxxxxx
Wells Fargo Confidential
This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at
http://archive.midrange.com/midrange-l.
midrange.com
