RE: IBM i security question -- MIDRANGE-L

× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.

Just tested this scenario (a limited capabilities user typing GO MAIN)

The user gets CPD0175 Command GO in library *LIBL not allowed

Gad

date: Tue, 22 Jun 2021 20:38:17 +0000
from: Rob Berendt <rob@xxxxxxxxx>
subject: RE: IBM i security question

Quite simple really.
CHGCMD CMD(SIGNOFF) ALWLMTUSR(*YES)
So your users can have command line but only to the commands with
ALWLMTUSR(*YES)

Here's a scary thing to try:
Sign on as a user with limited capability
Type in this command:
GO MAIN
4. Files, libraries, and folders
1. Files

1. Work with files
4=Delete
Or
7. Data File Utility (DFU)

This is why we changed all limited capability users from
Initial menu . . . . . . . . . . MAIN
To
Initial menu . . . . . . . . . . *SIGNOFF

With *SIGNOFF if they exit their initial program they are signed off
instead of returned to the MAIN menu.

That project to secure the data so they can only get to it via
"Application Only Access" keeps getting back burnered.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.