RE: AF errors after setting up SSH connections with BASH Shell

Interesting Aaron. We follow the idea of least privileged access and have *PUBLIC set to *EXCLUDE.
Do you mind temporarily trying to set *PUBLIC to *EXCLUDE on your machine and restarting a web server to see if AF entries are generated by QTMHHTTP?

-----Original Message-----
From: Aaron Bartell [mailto:aaronbartell@xxxxxxxxx]
Sent: Wednesday, February 17, 2016 11:02 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
Subject: Re: AF errors after setting up SSH connections with BASH Shell

What permissions does everyone have set for QTMHHTTP on "/QOpenSys/opt".

% ls -all /QOpenSys
drwxr-sr-x 3 aaron 0 8192 Dec 17 11:30 opt


5250> DSPAUT OBJ('/QOpenSys/opt')

Display Authority

Object . . . . . . . . . . . . : /QOpenSys/opt
Type . . . . . . . . . . . . . : DIR
Owner . . . . . . . . . . . . : AARON
Primary group . . . . . . . . : *NONE
Authorization list . . . . . . : *NONE

Data --Object Authorities--
User Authority Exist Mgt Alter Ref
*PUBLIC *RX X X X X
AARON *RWX X X X X


​HTH,​
Aaron Bartell
litmis.com - Services for open source on IBM i


On Wed, Feb 17, 2016 at 9:53 AM, Dan Lanza <DLanza@xxxxxxxxxxxxxxx> wrote:

So with further experimentation I noticed if I disable SSHD with
"ENDTCPSVR SERVER(*SSHD)" the AF errors still occur. However if I
rename the "/QOpenSys/opt" directory to something else "/QOpenSys/opt-backup"
while SSHD is off, the AF errors do not occur (not even for the new path).
This leads me to believe IBM Web Administration for i specifically
tries to access "/QOpenSys/opt" if it exists upon startup.

What permissions does everyone have set for QTMHHTTP on "/QOpenSys/opt".
I'd like to confirm whether or not this is typical behavior before I
just set permissions to stop the AF errors.