× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. June 2021

Re: IBM i security question

This is for our office manager:

INLPGM SIGNON
*LIBL
INLMNU OFCMGR1
*LIBL
LMTCPB *YES

The initial program changes the device text to indicate the last signon,
like this:

<workstation> <userid> 06/23/21 08:00:38

Then that program ends and the initial menu is displayed.


On Wed, Jun 23, 2021 at 1:26 PM Rob Berendt <rob@xxxxxxxxx> wrote:

There's two parts of a user profile we are talking about here.
Initial program to call . . . . INLPGM
Initial menu . . . . . . . . . . INLMNU

Only *MENU objects may appear in INLMNU - Initial menu.

A *PGM object, which may display a menu of choices, would more likely be
in INLPGM - Initial program to call.

Let's say you do have a *PGM object listed in INLPGM which presents a
"menu". Why would you leave MAIN as their menu if the program should
somehow abort out? Why not leave *SIGNOFF as their initial menu? Or USER
instead of MAIN?

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Jeff Crosby
Sent: Wednesday, June 23, 2021 1:00 PM
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: IBM i security question

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.


It may not be an IBM supplied menu. It could be an application menu.


On Wed, Jun 23, 2021 at 12:40 PM Rob Berendt <rob@xxxxxxxxx> wrote:

Why would your limited capability users have an initial menu?
What menu is it? MAIN? USER? USER might not be as risky as MAIN.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Gad
Miron
Sent: Wednesday, June 23, 2021 12:26 PM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: RE: IBM i security question

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and know
the content is safe.


Right

FWIW, All our Limited Capabilities users have an initial Menu

Gad






date: Wed, 23 Jun 2021 13:27:35 +0000
from: Rob Berendt <rob@xxxxxxxxx>
subject: RE: IBM i security question

Yes, it was pointed out to me that GO is not allowed from a user with
limited capabilities.
However try this
CRTUSRPRF DUMMY PASSWORD(DUMMY) LMTCPB(*YES)
Sign on as DUMMY.
You will be at the MAIN menu.
So, if you believe that you have a great " Initial program to call .
. .
. INLPGM" set up then I suggest you make their "Initial menu . . . . .
.
.
. . . INLMNU" set to *SIGNOFF.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com


-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of
Gad
Miron
Sent: Wednesday, June 23, 2021 9:22 AM
To: midrange-l@xxxxxxxxxxxxxxxxxx
Subject: RE: IBM i security question

CAUTION: This email originated from outside of the organization. Do not
click links or open attachments unless you recognize the sender and
know
the content is safe.


Just tested this scenario (a limited capabilities user typing GO MAIN)

The user gets CPD0175 Command GO in library *LIBL not allowed

Gad



date: Tue, 22 Jun 2021 20:38:17 +0000
from: Rob Berendt <rob@xxxxxxxxx>
subject: RE: IBM i security question

Quite simple really.
CHGCMD CMD(SIGNOFF) ALWLMTUSR(*YES)
So your users can have command line but only to the commands with
ALWLMTUSR(*YES)

Here's a scary thing to try:
Sign on as a user with limited capability
Type in this command:
GO MAIN
4. Files, libraries, and folders
1. Files

1. Work with files
4=Delete
Or
7. Data File Utility (DFU)

This is why we changed all limited capability users from
Initial menu . . . . . . . . . . MAIN
To
Initial menu . . . . . . . . . . *SIGNOFF

With *SIGNOFF if they exit their initial program they are signed off
instead of returned to the MAIN menu.

That project to secure the data so they can only get to it via
"Application Only Access" keeps getting back burnered.


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1
Group Dekko
Dept 1600
Mail to: 7310 Innovation Blvd, Suite 104
Ft. Wayne, IN 46818
Ship to: 7310 Innovation Blvd, Dock 9C
Ft. Wayne, IN 46818
http://www.dekko.com



--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com


------------------------------

Subject: Digest Footer

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) digest
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription
related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com


------------------------------

End of MIDRANGE-L Digest, Vol 20, Issue 889
*******************************************

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com



--


*Jeff Crosby*
VP Information Systems
UniPro FoodService/Dilgard
P.O. Box 13369
Ft. Wayne, IN 46868-3369
260-422-7531
direct.dilgardfoods.com

The opinions expressed are my own and not necessarily the opinion of my
company. Unless I say so.
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com




As an Amazon Associate we earn from qualifying purchases.

This thread ...
Follow-Ups:
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.