Re: disable all Q* ibm supplied profiles and chaning default passwords

[DrFranken <midrange@xxxxxxxxxxxx>]

If OS functions are failing with QSECOFR disabled you have changed 
defaults in a bad way. IBM does not deliver the system to run with 
QSECOFR for anything.

MANY of my customers run with QSECOFR disabled 24x7. Its use is heavily 
restricted and of course always remember if needed you CAN still sign on 
with a disabled QSECOFR at the defined system console device.

Certainly the vast majority of IBM Profiles can have no password and / 
or can be disabled but simply doing all of them will likely cause some 
issues. Testing is required!!


        - Larry "DrFranken" Bolhuis

www.Frankeni.com
www.iDevCloud.com - Personal Development IBM i timeshare service.
www.iInTheCloud.com - Commercial IBM i Cloud Hosting.

On 10/9/2019 8:55 AM, Justin Taylor wrote:
> I agree with Rob.  We've had QSECOFR disabled a few times and all manner of OS functions began failing.  YMMV
>
>
>
> -----Original Message-----
> From: Steve McKay [mailto:samckay1@xxxxxxxxx]
> Sent: Wednesday, October 09, 2019 7:12 AM
> To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
> Subject: Re: disable all Q* ibm supplied profiles and chaning default passwords
>
> I respectfully disagree - QSECOFR is disabled on all of my partitions (my user profile is QSECOFR equivalent) and is only enabled when some lame POS (piece of software) absolutely must have QSECOFR to install - which is almost never.  Additionally, I have been in many security sessions where it was specifically recommended to disable QSECOFR.
>
> Additionally, QPGMR,QSRV, and QSYSOPR are disabled on all partitions.  All other 'Q' profiles are left as shipped unless I have stumbled across some IBM document that specifically states that they can be disabled.
>
> There are a few Q profiles that simply won't allow you to change them period and a few that I don't think I would want to disable (such as QTCP, QLPINSTALL, and QSYS to name a few).
>
> Thanks,
>
> Steve McKay
> (205) 585-8424
> samckay1@xxxxxxxxx
>
>
>
> On Tue, Oct 8, 2019 at 4:21 PM Rob Berendt <rob@xxxxxxxxx> wrote:
>
> > Do not disable QSECOFR.  So much will fail.
> > You know how you can adopt programs to run under QSECOFR?
> > You know how you can use profile swapping to run under QSECOFR?
> > Well, IBM has some internal methods which are not known to us Muggles
> > which also run under QSECOFR.  I found this out by tapping the audit
> > journals in an effort to find when high profile users are being used.
> > It happens so often it will blow your mind.
> >
> > Rob Berendt
> > --
> > IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600
> > Mail to:  2505 Dekko Drive
> >            Garrett, IN 46738
> > Ship to:  Dock 108
> >            6928N 400E
> >            Kendallville, IN 46755
> > http://www.dekko.com