Re: Use of adopted profiles

[a4g atl <a4ginatl2@xxxxxxxxx>]

All. Thank you.

I know its a sticky subject and this has been a good reminder of the
pitfalls.

I have used authorization lists in the past too, but it was subsequently
recommended not to use them. I don't recall the reason but I am happy to
test that option again.

Once again, Thanks

Darryl.


On Sun, Oct 7, 2018 at 1:58 PM a4g atl <a4ginatl2@xxxxxxxxx> wrote:

> Jim
>
> The objects are not necessarily owned by the correct owner. I also plan to
> use 2 group profiles, 1 to own the objects. The second would be a basic
> group profile to link all users to but with very limited access, enough to
> allow the users to sign on and access their menus. In this way we would
> only need to manage 2 profiles, hopefully.
>
> Additional group profiles may be used for remote access such as Excel
> up-loaders, and other users retrieving data off the system.
>
> Darryl
>
> On Fri, Oct 5, 2018 at 10:49 AM Jim Oberholtzer <
> midrangel@xxxxxxxxxxxxxxxxx> wrote:
>
> > Darryl:
> >
> > From my perspective this is the correct approach.
> >
> > What I don't understand is why you grant authority to a group profile?  If
> > that's the same profile that owns the objects, then it does not need
> > explicit authority.  With adopted authority you won't need additional
> > group
> > profiles.   In fact the owner does not need to be a group profile at all,
> > just an owner.
> >
> > I have several customers that have implemented exactly what you are
> > proposing.  The only catch came with submitted jobs, when adopted
> > authority
> > was needed for those jobs to run.  We had a bit of tinkering to do in
> > order
> > to get past that.
> >
> > The security guide on the information center is OK, and I've not seen a
> > Redbook updates since V6R1.  There is a Redbook on Row/Column security but
> > that does not really apply to your use case.
> >
> >
> > --
> > Jim Oberholtzer
> > Agile Technology Architects
> >
> >
> > -----Original Message-----
> > From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
> > a4g
> > atl
> > Sent: Friday, October 05, 2018 9:08 AM
> > To: midrange-l@xxxxxxxxxxxx
> > Subject: Use of adopted profiles
> >
> > Is there a document that describes how the adopted authority works and
> > maybe
> > best practices? I am reviewing a project to lock the system down and it
> > has
> > been a long time since I last set up a highly secure system.
> >
> > My plan is to
> > - revoke all authorities from user libraries, objects and the IFS.
> > - Grant authority to a group profile.
> > - The group profile will own all objects.
> > - Users will have none or limited authority directly.
> > - When users signon to the menu, the menu program will grant authority
> > whilst using the job. When they sign off, they will have no authority.
> >
> > Objective:
> > - Prevent unauthorized access to the system
> > - There are users on multiple systems accessing this system and its wide
> > open. - Plan to grant authority to objects only where required example
> > read
> > rights to file where a remote system needs to access files to retrieve
> > data
> > and so on.
> >
> > The same will apply to the IFS.
> >
> > What are the best practices today? I know some folk don't like this
> > approach
> > but it is one of the cleanest and easiest approaches to implement and
> > maintain.
> >
> > TIA
> >
> > Darryl Freinkel
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
> > unsubscribe,
> > or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
> > moment to review the archives at https://archive.midrange.com/midrange-l.
> >
> > Please contact support@xxxxxxxxxxxx for any subscription related
> > questions.
> >
> > Help support midrange.com by shopping at amazon.com with our affiliate
> > link:
> > http://amzn.to/2dEadiD
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/midrange-l.
> >
> > Please contact support@xxxxxxxxxxxx for any subscription related
> > questions.
> >
> > Help support midrange.com by shopping at amazon.com with our affiliate
> > link: http://amzn.to/2dEadiD