Re: File protection basics

Hello Gad

Do you have a development LPAR or machine, or is everything done on the production server? The latter gets more complicated, of course.

First, ******no programmer should have authority to change any production object directly******. And this is not because one of them might do something malicious on purpose, they might just do something accidentally.

So you need a process, a software change management (SCM) application, or a version control system like GIT.

You make a copy of any source into a library you create to be the programmer's sandbox. Data files should be copied to that sandbox, as well, for the task the programmer is working on. Those data files would be cleared or deleted after the task is done.

So basically you debug development versions of programs over data copied from production, something like that.

Once developer testing is done, have some kind of tooling that will allow a manager to approve installation and maybe do the copy back to production and maybe even compile the changes. You really need to have separation of duties, to minimize accidents and to have auditability.

That's a very sketchy description, others can add to it, please, or make corrections.

Regards
Vern

On 10/2/2020 10:02 AM, Gad Miron wrote:

And while we're grappling with the issue..

How do I strip Programers on our Prod machine of their (*ALLOBJ) Authority
and still let them debug and fix any/all PGMs/Files

TIA
Gad

Then I thought why not create a user profile with no special authorities
and see how it affects me when I use it.
</snip>
That's not a bad plan. Be sure to use that as your primary, until you run
into a road block you have to immediately address and just have to use your
existing profile.

It also might be a good idea to contact a power user you have a good
relationship with (buying a doughnut is a good idea on our side of the
pond) and trying that with them also.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com