RE: [EXTERNAL] Re: File protection basics

Charles is correct
However, by taking away *ALLOBJ from profiles, that action may impede them from doing other things they are allowed to do right now
So - you have to carefully analyze what may no longer happen by taking *ALLOBJ away from user profiles

Been there - done that - unfortunately

Alan Shore
E-mail : ASHORE@xxxxxxxx
Phone [O] : (631) 200-5019
Phone [C] : (631) 880-8640
'If you're going through hell, keep going.'
Winston Churchill

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Tuesday, September 1, 2020 11:15 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: [EXTERNAL] Re: File protection basics

How many user profiles have *ALLOBJ special authority?

That need to be severely limited to secure anything on the i.

But yes, given your requirements, adopted authority will meet your needs.

Create one or two profiles, perhaps a couple of authorization lists and boom. Only users allow access to the specified program may access the table and only by using that program.

Unless they have *ALLOBJ...thus the first question.

Charles

On Tue, Sep 1, 2020 at 8:49 AM Dave <dfx1@xxxxxxxxxxxxxx> wrote:

Hi,

I've been given the task of rendering a few files containing banking
data "secure". I don't know much about this subject at all, but I've
the feeling that might be more than most in this company!

The requirement is that the files involved become the property of the
owner of the program that performs the updates and writes to the
files. Nothing is mentioned about mere consulting of banking data.
Modifications via SQL and DFU are to be prohibited. Only certain users
will be able to use the program that can modify the files.

I think I'm capable of putting that all into place without help, but
I'm sure there are many loopholes in this proposed solution to prevent fraud.
I'm wondering what a good strategy would be and how to implement it.

Any advice would be much appreciated.

Dave
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.

Help support midrange.com by shopping at amazon.com with our affiliate link: https://amazon.midrange.com