Re: File protection basics

I've discovered that when the company bought their new machine in 2013,
they suddenly started having problems with user authorities and found it
necessary to add *ALLOBJ to All the user profiles!!
I'm guessing it was QSECURITY that changed and new users didn't have the
authority necessary
What those authorities are I don't yet know
I was looking for a command to extract all the authorities on the system
but that doesn't look that easy.
Then I thought why not create a user profile with no special authorities
and see how it affects me when I use it.

Rob Berendt <rob@xxxxxxxxx> schrieb am Di., 29. Sept. 2020, 15:43:

I'll give you an example. Here it was discovered that the users had an
initial program which jumped them directly into our ERP package. They also
had limited capabilities set to yes, which basically means no command
line. They had no special authority. However, instead of their initial
menu being *SIGNOFF it was set to QSYS/MAIN. Actually this is a current
issue I'll get around to one of these days...

MAIN
4. Files, libraries, and folders
...
6. Query Utilities
7. Data File Utility (DFU)

4. Files, libraries, and folders
1. Files
1. Work with files
File . . . . . . . . . . . . . . *ALL
Library . . . . . . . . . . . ERPLXF
4=Delete

Yet another reason we are going to implement "Application Only Access".

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Charles Wilt
Sent: Tuesday, September 29, 2020 9:24 AM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: File protection basics

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.


On Tue, Sep 29, 2020 at 12:59 AM Dave <dfx1@xxxxxxxxxxxxxx> wrote:

This may be a silly question, but I'll ask anyway: why not just let the
program check the user id before allowing any particular level of access

to

the files? I'm guessing that in this situation, that may be necessary,
given the fact that everyone has special authority *ALLOBJ.

Because the fact that users have *ALLOBJ means they don't have to use a
program to read/change/delete data...or even the program objects.

If you don't already have this book, I highly recommend it.

https://www.amazon.com/Security-Administration-Compliance-Woodbury-2016-05-11/dp/B01JXQM65I

Charles
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com