RE: Question on ACS and working with the IFS....

Not arguing, but trying to come up with a solution...

And in case my tone doesn't come across right, thank you for that. If I'm advocating that IBM look at things differently, I need to be equally willing to listen to other options.

Why the security on CRTLIB? Are people really creating these whilly-nilly?
Could you use a command exit point program instead and track when they ran it?
Or if they are using it in an unsupported fashion, the command exit point program could kill it.
If "after the fact" tracking is acceptable there's probably some journal entry code applicable to CRTLIB.

Some of that is carry-over from my ancient days in BBS/early Internet days, where users proliferating new folders was a key sign that someone had hacked your system and was now using it to store stuff that could get you thrown in jail.

I'm also a little concerned with DLTLIB. Wouldn't that be better served by securing the data so that if
they are not allowed to delete the library it puts a hard stop to it? I mean, if you're relying upon DLTLIB then
couldn't one just do a DSPCMD DLTLIB, figure out the CPP and bang on the parameters until they get calling
the CPP directly right?

All of our libraries are secured and no user outside of I/S has the rights to delete any of them. With the default authority on new libraries, she wouldn't have rights to delete the library either.

The latest is that technician at IBM looked at the sequence of commands and doesn't understand the use of a save file in the QSYS file system either. Or the use of CRTLIB/DLTLIB. They've asked for screen shots and documentation of the process we're following.


_____________________________________________________________________
Spirax-Sarco Engineering Plc. This e-mail has been scanned for viruses by Cisco Cloud Email Security.