Re: Recommendation for IBMi privileges for an outsourcer to support an IBMi environment

On Sat, Jun 27, 2020 at 4:15 AM <midrangel@xxxxxxxxxxxxxxxxx> wrote:

Laurence:

If they are truly a system administrator, without adding some of the newer
security features that IBM gave us in the more recent Technology Refreshes
and/or V7R4, there is next to no way to stop them from seeing production
data. If they want to, they will. The moment they have access to a
QSECOFR
type profile, that door is open and you will have a real hard time shutting
it.

DO NOT let them use QSECOFR, in either IBM i or SST. Keep that profile
for
your organization. Create a new profile specifically for them that has
*ALLOBJ and *SECADM in addition to the list you provided. Do not put
*AUDIT in the list.

Create a profile in SST that has the authority you wish to give them, but
frankly to do the administrators job, they will need everything there.

Note: giving someone *JOBCTL also includes *SPLCTL so that's redundant.
No problem with it, just redundant.

Your list of special authorities below with allow them to do 90% of what
they need to do.

Who is going to manage user profiles? That list will not allow user
profile
maintenance ( a good thing given your questions premise ). To maintain
user
profiles you would need authority to the profile itself, and *SECADM.

--
Jim Oberholtzer
Agile Technology Architects

That's really useful information. Thanks. Security profiles are going to be
managed by our internal security operations team. Would love to have LDAP
integration but this is a legacy application and nobody wants to invest in
the platform, So our security operations team take requests from a portal
and enable them manually. That means the oursourcer won't need *SECADM
presumably either. But won't *ALLOBJ mean they can see the data unless we
implement some of the suggestions discussed elsewhere in this thread?