Re: How to secure IBM Navigator For I

[Jim Oberholtzer <midrangel@xxxxxxxxxxxxxxxxx>]

What Rob is pointing out is the Application Administration is 
independent of the thick client or the web based client. It will act on 
both.

You are correct that the Application is not quite granular enough at 
some levels but it can block most things. You'll need to look to the 
underlying commands and APIs to really restrict those functions. You can 
start by making sure your users do not have *JOBCTL or *SPLCTL. That 
will go a long way to achieving what you want if I understand the 
requirements properly.

Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects

On 2/6/13 3:14 PM, Lorne Sturgeoff wrote:
> You're missing a point. The System_i_Navigator PC application is an
> installable application and when you install it you get to choose which
> functions will go on a given PC. The web application has no such capability.
> The is not the same as comparing Telnet to 5250 access.
>
> Application Administration will limit access to some functions however not
> all of the functions offered in the web version of Navigator are covered by
> Application Administration, for example, disk status and system status.
>
> Cheers,
> Lorne.
>
> wrote in message
> news:mailman.14238.1360184201.10847.midrange-l@xxxxxxxxxxxx...
>
> <snip>
> On the PC application we can control which functions get installed on the
> client. With the web function, they are all visible. Like you, I have a
> problem with this. There is information there that doesn't need to be made
> public to all users with a browser.
> </snip>
> Yes, you can control what gets installed on one person's PC.  However
> that's like saying since I didn't install the 5250 client on their PC I've
> effectively locked this person out of 5250 access.  You haven't.  There's
> nothing there to stop them from using DOS' TELNET command.
> It's better to secure the individual applications as IBM suggested - by
> using Application Administration.
>
>
> Rob Berendt
> -- IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 
> 1600 Mail to: 2505 Dekko Drive Garrett, IN 46738 Ship to: Dock 108 
> 6928N 400E Kendallville, IN 46755 http://www.dekko.com
> --