Re: File protection basics

Thanks to all who replied, you've made this a very fascinating amusing
subject indeed.

Looking closer at the user profiles, it seems that all the users have
authorities *ALLOBJ *SAVSYS *SPLCTL, with programmers having the
additional value *JOBCTL

QSECURITY is set to 40

We are on V7R1

This may be a silly question, but I'll ask anyway: why not just let the
program check the user id before allowing any particular level of access to
the files? I'm guessing that in this situation, that may be necessary,
given the fact that everyone has special authority *ALLOBJ.

Then again I'm also guessing that there are no objects already on the
system that require special authority to use them, and in that case taking
away *ALLOBJ from most profiles will not cause any problems.


On Mon, 28 Sep 2020 at 18:05, PaulMmn <PaulMmn@xxxxxxxxxxxxx> wrote:

...checking who complains...

May not be the best for public relations, but it is a lot more fun! (;

Plus, if no one complains, it means you nailed it.... or no one is
using that function.

Of course, when we first tightened our systems down, the programmers
complained the most! "We can't run as users and see where it
breaks!" Well, we fixed the test environment. Complaints dwindled.
Still got some, but 'security' won!


--Paul E Musselman

.


At 12:40 PM -0300 9/28/20,
=?UTF-8?Q?Roberto_Jos=C3=A9_Etcheverry_Romero?= wrote:

Also,
If you are running 7.4 (I think it was introduced in 7.4) you can run an
audit to check the effective permissions your users need in their daily
tasks. Which is a way better method to secure your system than closing the
doors and checking who complains...

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com