The short answer is as Rob has pointed out is the command exit.
You could get exotic and go several directions to accomplish your goal but
I'd guess the security option is the best. Secure all the objects first
then allow access as needed. I'm guessing you'll have to hire a couple of
people to manage that even if you use one of the several security products
out there.
Although I was doubtful that it would work, I thought about (and coded up
and example) routing program that would control what was able to run based
on an allowed object input file. The problem is as soon as control is
handed over to the IBM i object the routing program loses its ability to
control things. Not a solution. The initial request worked fine.
Subsequent request never came back to the routing program for a decision. I
can think of a way to make it work but performance would be awful, so not a
solution.
Bottom line, security and exit programs.
--
Jim Oberholtzer
Agile Technology Architects
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Paul
Nicolay
Sent: Monday, August 29, 2016 8:02 AM
To: Midrange Systems Technical Discussion
Subject: Re: Replace command processor
Hi,
I'm aware of these exits as well but it requires me to register them for
each command I want to control (which is every single command on the
system).
Fact is that I've a security system that is build on reject all, allow by
exeception ... which works the other way around.
Kind regards,
Paul
________________________________________
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxx> on behalf of Rob Berendt
<rob@xxxxxxxxx>
Sent: Monday, August 29, 2016 14:53
To: Midrange Systems Technical Discussion
Subject: Re: Replace command processor
WRKREGINF
Exit
Exit Point
Point Format Registered Text
QIBM_QCA_CHG_COMMAND CHGC0100 *YES Change command exit programs
QIBM_QCA_RTV_COMMAND RTVC0100 *YES Retrieve command exit program
Samples I've used this for:
1-Anyone with *SECADM signs off I want a PDF of their joblog emailed to me.
2-Anyone uses SNDDST, and it's for emailing then use the SNDEMAIL command
instead.
Other possible uses:
- Someone has an application with a home grown version of RUNSQL in it that
has different parameters in it, then change it to the IBM version which came
out with a later release.
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: Paul Nicolay <paul.nicolay@xxxxxxxxxx>
To: "midrange-l@xxxxxxxxxxxx" <midrange-l@xxxxxxxxxxxx>
Date: 08/29/2016 08:24 AM
Subject: Replace command processor
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
?Hi,
I wonder if it is possible to replace the OS/400 command processor ?
I would like to be able to control the command (ie. additional verifications
and/or change) before it is executed.
Kind regards,
Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related questions.
midrange.com
