Re: [Bulk] RE: QSTRUPPGM issues

Paul:

If you just wanted QSTRUP to run "as" QSECOFR you could just change the QSTRUPJD to specify user profile QSECOFR instead of QPGMR. But I would not recommend that approach.

My suggested approach creates a second "start up" program that performs only those actions that require QSECOFR to do them, so your existing QSTRUPPGM can remain "as is" and continue to run under QPGMR.

Also, in general I agree that you normally do not want "a bunch of jobs or programs" running "as QSECOFR" ...

In this case, when you do have a requirement to perform some tasks that need QSECOFR authority, you now have a way to do that, and it is "documented" (e.g. for the auditors) since you can show the subsystem description for QCTL, and the autostart job entries, and show the source code for the QSTRUP2 program (in this example).

HTH,

Mark S. Waterbury

> On 9/18/2014 10:01 AM, Steinmetz, Paul wrote:

Mark,

To make a long story short, the instructions below basically has QSTRUP run as QSECOR instead of QPGMR, correct.
This would solve many issues for me.
However, from a security stand point we should NOT be running jobs as QSECOFR, correct.
I just finished my 4-day extended security training course.

Paul