Re: QSYSOPR Security issue for Backups.

Stephanie,

Show us the authority for the file (what you gave us (below) is the attributes of the file)
I don't want to guess at the solution, but it is possible to create a file you have very limited
access to.

If the /tmp file still exists, what is it's authority?

The cmd - wrkaut '/tmp/brms/q1asav540051' will display - need to know
both object authorities and data authorities (F11 toggles)

Jim

----- Original Message ----- From: <Stephanie.Cox@xxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Wednesday, June 11, 2014 7:51 AM
Subject: Re: QSYSOPR Security issue for Backups.

The user profile I replaced was an individual with QSECOFR authority. He
left the company years ago... ROBOT submits the job. Robot does not
allow QSECOFR to submit jobs. QSYSOPR does have authority to backup the
'Entire' systems. I don't have an issue with the weekly backup, just this
BRMS object daily.

It appears QSYSOPR created the object on the previous backup, as he is the
owner....? but doesn't have authority to the object: See below screens
of message and attributes of object:

Not authorized to object. Object is /tmp/brms/q1asav540051.

Object . . . . . . : /tmp/brms/q1asav540051

Type . . . . . . . . . . . . . . . . . : STMF

Owner . . . . . . . . . . . . . . . . : QSYSOPR
System object is on . . . . . . . . . : Local
Auxiliary storage pool . . . . . . . . : 1
Object overflowed . . . . . . . . . : No

Coded character set ID . . . . . . . . : 37
Hidden file . . . . . . . . . . . . . : No
PC system file . . . . . . . . . . . . : No
Read only . . . . . . . . . . . . . . : No

Need to archive (PC) . . . . . . . . . : Yes
Need to archive (System) . . . . . . . : Yes

Object . . . . . . : /tmp/brms/q1asav540051

Creation date/time . . . . . . . . . . : 06/10/14 04:54:14
Last access date/time . . . . . . . . : 06/11/14 07:39:51
Data change date/time . . . . . . . . : 06/10/14 04:56:37
Attribute change date/time . . . . . . : 06/10/14 04:56:37

Size of object data in bytes . . . . . : 404816
Allocated size of object . . . . . . . : 524288
File format . . . . . . . . . . . . . : *TYPE2
Size of extended attributes . . . . . : 0
Storage freed . . . . . . . . . . . . : No
Disk storage option . . . . . . . . . : *NORMAL
Main storage option . . . . . . . . . : *NORMAL

Auditing value . . . . . . . . . . . . : *ALL


Proudly bringing you North America's best-selling
MCI coaches and Europe's top luxury brand, Setra.
Stephanie Cox
Senior Systems Administrator
Motor Coach Industries
7001 Universal Drive
Louisville, KY 40258
Mobile: 502-475-7098
Office: 502-318-3211
Direct Fax: 502-318-8257
E-Mail: Stephanie.Cox@xxxxxxxxxxxx
www.mcicoach.com
www.setra-coaches.com




From: "franz9000" <franz9000@xxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>,

Date: 06/10/2014 10:52 PM
Subject: Re: QSYSOPR Security issue for Backups.
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Stephanie,

When you granted authority to the parent directories, that does not filter

down
to the already existing files.

When you say you changed automatic backup to run " by QSYSOPR", what
exactly
did you change?
It's been a few years since I setup a BRMS shop, and perhaps
others can chime in, but I don't remember ever trying to using QSYSOPR to
run jobs.

If the /tmp file still exists, what is it's authority?
The cmd - wrkaut '/tmp/brms/q1asav540051' will display - need to know
both object authorities and data authorities (F11 toggles)
Jim

----- Original Message ----- From: <Stephanie.Cox@xxxxxxxxxxxx>
To: "Midrange Systems Technical Discussion" <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, June 10, 2014 12:47 PM
Subject: RE: QSYSOPR Security issue for Backups.

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Stephanie.Cox@xxxxxxxxxxxx
Sent: Tuesday, June 10, 2014 8:11 AM
To: midrange-l@xxxxxxxxxxxx
Subject: QSYSOPR Security issue for Backups.

I am trying to remove the user who originally set up this iSeries - he's
been gone for years. I have changed the automatic backup to be run by
QSYSOPR -and no matter what - continue to receive this message. 'Not
authorized to object. Object is /tmp/brms/q1asav540051'. Of course the
number changes each day. I have granted authority to QSYSOPR for /tmp
/tmp/brms. Finally I gave QSYSOPR *ALLOBJ authority in the profile -

and

still got this message last night. Any/All ideas would be greatly
appreciated.


Thanks

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.