× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. September 2015

RE: Odd security issue with adopted authority

It should be easy enough to determine on your dev system.

o Duplicate COKEK's profile to the dev system.
o Write a small program to imitate QZRCSRVS. Have it pass the expected parameters if any are involved.
o Submit the program to batch using COKEK as the user.

SBMJOB CMD(CALL PGM(MYTEMPPGM)) USER(COKEK)

Other things being equal, you should receive the same CPF9802 message if your suspicion is correct.


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Monday, September 14, 2015 1:28 PM
To: Midrange Systems Technical Discussion
Subject: Re: Odd security issue with adopted authority

The new group only authorized to reset profiles or delete them (this is controlled in the Win app).
The existing group could add users, reset and delete.
New group can still reset and delete, but existing group can no longer add.
Am beginning to suspect something in the way connections are pooled and which profile is used in connection with each operation.
In this log, user COKEK is not the user who issued the request. They are the user who first started this QZRCSRVS job.

Message ID . . . . . . : CPF9802 Severity
Date sent . . . . . . : 09/14/15 Time sent
Message type . . . . . : Escape
From . . . . . . . . . : COKEK CCSID .

From program . . . . . . . . . : QSYUP
From library . . . . . . . . : QSYS
Instruction . . . . . . . . : 3F1D

To program . . . . . . . . . . : K002C
To library . . . . . . . . . : KMD
To module . . . . . . . . . : K002C
To procedure . . . . . . . . : K002C
To statement . . . . . . . . : 2080

Time sent . . . . . . . . . . : 13:53:17.924614
Jim

On Mon, Sep 14, 2015 at 3:34 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>
wrote:

How does the new group of users differ from existing, comparable users
that can use the process?


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Jim Franz
Sent: Monday, September 14, 2015 12:27 PM
To: Midrange Systems Technical Discussion
Subject: Re: Odd security issue with adopted authority

I'm not clear on what this means in the IBM doc:
"There is a restriction that has been in existence since release 7 of
the System 38 operating system that requires the user running the CLP
to have authorization to any associated group profiles being
referenced in the command."

What level of authorization? It can't be just *USE because *public
already has that.
We are still not seeing "what has changed", except that a new group of
users started using the process on Thursday, but we see successful
CRTUSRPRF's on Thursday, but not Friday. We do break all the
connections between Win and i each night.
Jim

On Mon, Sep 14, 2015 at 1:51 PM, Monnier, Gary
<Gary.Monnier@xxxxxxxxx>
wrote:

Charles,

My response does not preclude your answer. Quite the opposite actually.
IBM doesn't specify profile V8GEOFFW has *ALLOBJ authority. The
object owner having *ALLOBJ authority should cover access to any
group profile being utilized. IMHO, something changed so that the
program owner no longer has authority to group profiles.

Thanks,

Gary Monnier


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf
Of Charles Wilt
Sent: Monday, September 14, 2015 10:36 AM
To: Midrange Systems Technical Discussion
Subject: Re: Odd security issue with adopted authority

Here's a tech note linked to in thread I posted...
http://www-01.ibm.com/support/docview.wss?uid=nas8N1013328

Charles

On Mon, Sep 14, 2015 at 1:20 PM, Monnier, Gary
<Gary.Monnier@xxxxxxxxx>
wrote:

It was working until Friday and suddenly stopped and nothing has
changed?
Hmm. Forgive me if I'm skeptical.

IBM's manual states the following about the CRTUSRPRF...

Restrictions: The user of this command must have:

Security administrator (*SECADM) special authority
Use (*USE) authority to the initial program, initial menu,
job description, message queue, output queue, and
attention-key-handling program (if specified)
Change (*CHANGE) and object management (*OBJMGT) authorities
to the group profile and supplemental group profiles (if specified).

Your adopted authority scheme meets these requirements correct? If so
your program should be working.

Did the program get promoted to production recently? Did the user
profile parameter get changed to *USER or, did the program owner
get changed during the promotion? Maybe an audit stated special
authorities should be removed from the user profile and something
was removed? Is there an exit program in place for exit point
QIBM_QSY_CRT_PROFILE?

Gary Monnier


-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On
Behalf Of Jim Franz
Sent: Monday, September 14, 2015 9:41 AM
To: Midrange Systems Technical Discussion
Subject: Odd security issue with adopted authority

This has worked for several years, and no recent program change,
ptfs, or profile change that we can detect. It worked up to Friday
morning...

Looking at an issue where a program that adopts authority (User
profile
. .
. . . . . . . : *OWNER)
and owner has *ALLOBJ and *SECADM is executing a CRTUSRPRF and not
authorized to the Group Profile of the user to be created.
This is a client job (C#) calling my program

Job . . : QZRCSRVS User . . : QUSER Number . . . :
008237

Message ID . . . . . . : CPF9802 Severity . . . . . . . : 40
Message type . . . . . : Escape
Date sent . . . . . . : 09/14/15 Time sent . . . . . . :
11:4

Message . . . . : Not authorized to object GR_NONXYZ in QSYS.
Cause . . . . . : You do not have the correct authority for object
GR_NONXYZ in library QSYS type *USRPRF.
Recovery . . . : Contact your security officer or the object owner
to
obtain the correct authority and try your request again.

This still works in out test partition but not in production.
We allow a select group of users, outside of IT, to manage outside
users.
V7R1.
Owner has *ALLOBJ *AUDIT *IOSYSCFG *JOBCTL *SAVSYS
*SECADM *SERVICE *SPLCTL

Program still works fine to change or delete profiles. Only
CRTUSRPRF fails .

Any ideas before call IBM?

Jim Franz
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please
take a moment to review the archives at
http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at http://archive.midrange.com/midrange-l.

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.