Re: IBM i security question

"users having command line access, because it opens them up to being able
to do a lot of damage to the system if they so desire"
Not if you've got security set up properly...

Take your example of ENDSBS, this command requires *JOBCTL special
authority. That shouldn't be given to regular users. Sysops, Sysadmins
and perhaps developers. (Assuming they handle on-call duties)

*JOBCTL in particular is often given out in the mistaken belief it's needed
for a user to end or otherwise control their own jobs. That is not the
case. It's only required for users to control another's jobs.

If you think you're safe with Limit Capabilities *YES, you're
sadly mistaken.

Pick up a copy of Carol's book...
https://www.mc-store.com/collections/carol-woodbury/products/ibm-i-security-administration-and-compliance-third-edition

Charles


On Tue, Jun 22, 2021 at 2:15 PM Howie, Bill <BHowie@xxxxxxxxxxxxxxxx> wrote:

Hello all,

We have an environment where some users are currently set up with the
Limit Capabilities option set to *NO on their user profile. In conjunction
with that, we have an array of homegrown commands that have been created as
shortcuts to different programs within the system. I really don't like the
users having command line access, because it opens them up to being able to
do a lot of damage to the system if they so desire. It seems to me the
only alternative would be to remove the command line access and change
everything they have commands for to run off of menu options. Is there a
way to somehow limit them to the homegrown commands but prevent them from
access to things like ending subsystems or other jobs in the system, etc.?
One of these folks is of the user class *USER and one is of the *PGMR user
class (I'm guessing pretty obviously we'd want to downgrade the user class
on this one). Or is it that if you have command line access, it's to all
commands and there is really no w
ay to limit it? Any info on this would be greatly appreciated. Thanks
for your time!

[Related image]<https://www.hc-companies.com/>Bill Howie
Senior ERP Programmer/Analyst
Direct: 330.487.3739 | Cell: 330.888.8085 | Toll Free: 800.225.7712
2450 Edison Blvd, Suite 3, Twinsburg OH 44087
hc-companies.com<https://www.hc-companies.com/>
Leader in Horticultural Containers
[cid:image003.png@01D76781.CECC8130]<
https://www.linkedin.com/company/the-hc-companies>
[cid:image004.png@01D76781.CECC8130] <
https://www.facebook.com/HCCompanies/>
[cid:image005.png@01D76781.CECC8130] <
https://www.instagram.com/hccompanies/>
[cid:image006.png@01D76781.CECC8130] <https://twitter.com/hc_companies>

Disclaimer

The information contained in this communication from the sender is
confidential. It is intended solely for use by the recipient and others
authorized to receive it. If you are not the recipient, you are hereby
notified that any disclosure, copying, distribution or taking action in
relation of the contents of this information is strictly prohibited and may
be unlawful.

This email has been scanned for viruses and malware, and may have been
automatically archived by Mimecast Ltd, an innovator in Software as a
Service (SaaS) for business. Providing a safer and more useful place for
your human generated data. Specializing in; Security, archiving and
compliance. To find out more visit the Mimecast website.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com