RE: QSYS.LIB under IFS root

In a single word: "Yes".

Would a Unix administrator allow access to all the .bin files in the OS.
Highly doubtful.
Will you give Administrator Access to the developers for your Windows and
VMWare instances. Again Doubtful.

Why does everyone think that just because historically developers have had
access to the OS (outside of simply using it) in IBM i shops that it's the
right thing to do?

--
Jim Oberholtzer
Agile Technology Architects

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
iseriesstuff
Sent: Monday, April 27, 2020 7:14 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: Re: QSYS.LIB under IFS root

What if the share is given only explicit authority (pgmr, admin, etc), a
name that is not viewable via explorer (containing the $ character), and
maximum users is set to 1. Would this still be an audit issue?


On 4/27/2020 7:28 AM, Rob Berendt wrote:

Do not modify the settings on QSYS.LIB Immediately eliminate the share
on the root. Just do it. To create a share on the root directory here

will be accepted as your letter of resignation.

There may be some disruption as people now have to create shares specific

to their needs but a share on the root should have never have been done in
the first place. I would hope that you would fail an audit, if not your
auditors are not worth spit.

A nice initial generic share could be on the /home directory. Most users

should have their home directory set to something like this

User profile . . . . . . . . . . . . . . . : ROB
Home directory . . . . . . . . . . . . . . : /home/ROB

I could go on and on but it all boils down to you just need to stop the

share on root without any delay. NOW!!!!!!

There has been a recent case on this list from someone who got hit with

ransomeware and it attacked their IBM i because they had a share on the root
directory.

Rob Berendt

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com