Re: What commands should have ALWLMTUSR(*YES)?

here are the default commands allowed
https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_72/rzarl/rzarllmtcap.htm <https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_72/rzarl/rzarllmtcap.htm>

A user with limited capabilities can only run commands that are defined as being allowed to be used by limited users. The following commands are shipped by IBM with ALWLMTUSR(*YES):
Sign off (SIGNOFF)
Send message (SNDMSG)
Display messages (DSPMSG)
Display job (DSPJOB)
Display job log (DSPJOBLOG)
Start PC Organizer (STRPCO)
Work with Messages (WRKMSG)

On Oct 26, 2017, at 3:37 PM, Rob Berendt <rob@xxxxxxxxx> wrote:

In general I understand that people without command line access should not
have access to commands, except for a few with ALWLMTUSR(*YES).
An example of one that most people have access to is SIGNOFF.
And some could even argue against that. For example, no, I want them to
only run it from our whiz bang menu which logs their joblog to a PDF and
emails it to me.

But, in general, what commands should be that way?

And I am not willing to accept IBM defaults. For example, does the
general user population need access to EXPORTFS? "Hey, let's set up a
samba share of the root directory!" Then again, maybe it was only changed
this way on this lpar for some reason lost to time. Because it's not that
way on this other lpar that's newer and less modified.
But I digress...

If I do a Sys-Req 4 to see my messages do I need command line access to
DSPMSG?
If I do a Sys-Req 3 to see my job attributes do I need command line access
to DSPJOB?
If, after doing the Sys-Req 3, I take option 10 to look at the joblog do I
need command line access to DSPJOBLOG?




Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: http://amzn.to/2dEadiD