Re: IBMi admin MFA

Too many auditors get too big for their pants. Modifying an IBM supplied
profile (QSECOFR in particular) can lead to a bunch of land mines to step
on.

Generally I advise customers to 1) tell the auditors no and create an
exception to the audit for that (those) profiles. 2) Create a system where
the log in to the high authority profiles is tracked (Most of the security
related vendors have tools for that) which is relatively easy to build
yourself. Then you can show the audit trail to them and see that all is
well. Since the auditors will most likely start blowing steam when you
tell them no, you should be able to get the budget for the vendor tools to
track that activity, since they won't believe the home grown tooling.

--
Jim Oberholtzer
Chief Technical Architect
Agile Technology Architects


On Wed, Mar 30, 2022 at 1:07 PM Justin Taylor <jtaylor.0ab@xxxxxxxxx> wrote:

I contacted HelpSystems, and they cautioned me about doing this. They said
it would require making changes to IBM supplied profiles, which IBM
recommends against.


date: Wed, 30 Mar 2022 05:48:36 +0530

from: Chamara Withanachchi <chamaraw@xxxxxxxxxx>
subject: Re: IBMi admin MFA

Hi,

HelpSystems is having a good product and we have I done POC. It does a
very decent job.


Chamara

Sent from my iPhone

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/midrange-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

Help support midrange.com by shopping at amazon.com with our affiliate
link: https://amazon.midrange.com