RE: IBM i security question

[Gad Miron <gadmiron@xxxxxxxxx>]

Just tested this scenario (a limited capabilities user typing GO MAIN)

The user gets CPD0175   Command GO in library *LIBL not allowed

Gad

> date: Tue, 22 Jun 2021 20:38:17 +0000
> from: Rob Berendt <rob@xxxxxxxxx>
> subject: RE: IBM i security question
>
> Quite simple really.
> CHGCMD CMD(SIGNOFF) ALWLMTUSR(*YES)
> So your users can have command line but only to the commands with
> ALWLMTUSR(*YES)
>
> Here's a scary thing to try:
> Sign on as a user with limited capability
> Type in this command:
> GO MAIN
> 4. Files, libraries, and folders
> 1. Files
>
> 1. Work with files
> 4=Delete
> Or
> 7. Data File Utility (DFU)
>
> This is why we changed all limited capability users from
> Initial menu . . . . . . . . . .   MAIN
> To
> Initial menu . . . . . . . . . .   *SIGNOFF
>
> With *SIGNOFF if they exit their initial program they are signed off
> instead of returned to the MAIN menu.
>
> That project to secure the data so they can only get to it via
> "Application Only Access" keeps getting back burnered.
>
>
> Rob Berendt
> --
> IBM Certified System Administrator - IBM i 6.1
> Group Dekko
> Dept 1600
> Mail to:  7310 Innovation Blvd, Suite 104
>           Ft. Wayne, IN 46818
> Ship to:  7310 Innovation Blvd, Dock 9C
>           Ft. Wayne, IN 46818
> http://www.dekko.com