There are two setting in user profiles that affect commands, Limit Capabilities and initial menu. If the command line on the initial menu is *NONE they do not get a command line. *long or *short gives them a command line. Then on the commands themselves, there is the Allow limited users. If this is set to *NO, and the user profile is limited, they cannot use the command. Many of the IBM command are set not to allow limited users. Safe command will allow a limited user. I call them safe as you cannot do real damage but depending on your environment, they can still get to stuff you may not want them in. Go example the GO command does not allow limited users. I cannot find a command in QSYS that allows limited users. Signoff is one command that allows limited users.
Giving users access to command though is risky. Best to put all of your command into menus that you create and using authorization lists and other security measures to restrict access at the object level. We like initial menu of *SIGNOFF and initial program as a menu system. Users are given menu options based on their group profiles.
Chris Bipes
Director of Information Services
CrossCheck, Inc.
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Howie, Bill
Sent: Tuesday, June 22, 2021 1:16 PM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: IBM i security question
Hello all,
We have an environment where some users are currently set up with the Limit Capabilities option set to *NO on their user profile. In conjunction with that, we have an array of homegrown commands that have been created as shortcuts to different programs within the system. I really don't like the users having command line access, because it opens them up to being able to do a lot of damage to the system if they so desire. It seems to me the only alternative would be to remove the command line access and change everything they have commands for to run off of menu options. Is there a way to somehow limit them to the homegrown commands but prevent them from access to things like ending subsystems or other jobs in the system, etc.? One of these folks is of the user class *USER and one is of the *PGMR user class (I'm guessing pretty obviously we'd want to downgrade the user class on this one). Or is it that if you have command line access, it's to all commands and there is really no w ay to limit it? Any info on this would be greatly appreciated. Thanks for your time!
[Related image]<
https://www.hc-companies.com/>Bill Howie Senior ERP Programmer/Analyst
Direct: 330.487.3739 | Cell: 330.888.8085 | Toll Free: 800.225.7712
2450 Edison Blvd, Suite 3, Twinsburg OH 44087 hc-companies.com<
https://www.hc-companies.com/>
Leader in Horticultural Containers
[cid:image003.png@01D76781.CECC8130]<
https://www.linkedin.com/company/the-hc-companies> [cid:image004.png@01D76781.CECC8130] <
https://www.facebook.com/HCCompanies/> [cid:image005.png@01D76781.CECC8130] <
https://www.instagram.com/hccompanies/> [cid:image006.png@01D76781.CECC8130] <
https://twitter.com/hc_companies>
Disclaimer
The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.
This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more visit the Mimecast website.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
