Re: File protection basics

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

+1

At another employer we had to call the help desk, who would record it 
and give us access to a program we would inherit authority from. I don't 
remember if we had view authority there.

I think view authority - other than things like compensation and other 
personal data - I think that is usually OK. But not *CHANGE.

Vern

On 10/2/2020 11:32 AM, Charles Wilt wrote:
> While Vern has some good ideas, and I agree that no developer should
> regularly be able to make changes in production.. sometimes developer's
> need access to production.
>
> In that case, there should be some sort of documented process to allow them
> to gain elevated access...preferably one that then logs everything they do
> for review.
>
> You could roll your own, but there are third party apps to facilitate this.
> https://www.helpsystems.com/products/identification-and-access-management-software-ibm-i
>
> Charles
>
>
> On Fri, Oct 2, 2020 at 9:02 AM Gad Miron <gadmiron@xxxxxxxxx> wrote:
>
> > And while we're grappling with the issue..
> >
> > How do I strip Programers on our Prod machine of their (*ALLOBJ) Authority
> > and still let them debug and fix any/all PGMs/Files
> >
> > TIA
> > Gad
> >
> > Then I thought why not create a user profile with no special authorities
> > and see how it affects me when I use it.
> > </snip>
> > That's not a bad plan.  Be sure to use that as your primary, until you run
> > into a road block you have to immediately address and just have to use your
> > existing profile.
> >
> > It also might be a good idea to contact a power user you have a good
> > relationship with (buying a doughnut is a good idea on our side of the
> > pond) and trying that with them also.
> >
> > Rob Berendt
> > --
> > IBM Certified System Administrator - IBM i 6.1
> > Group Dekko
> > Dept 1600
> > Mail to:  7310 Innovation Blvd, Suite 104
> >            Ft. Wayne, IN 46818
> > Ship to:  7310 Innovation Blvd, Dock 9C
> >            Ft. Wayne, IN 46818
> > http://www.dekko.com
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at https://archive.midrange.com/midrange-l.
> >
> > Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> > questions.
> >
> > Help support midrange.com by shopping at amazon.com with our affiliate
> > link: https://amazon.midrange.com