Re: IBM User Profiles

[Charles Wilt <charles.wilt@xxxxxxxxx>]

Every profile in your list, except QSECOFR, has "No Password Indicator" ==
YES.

Which is exactly what IBM's documentation says, "except for QSECOFR are
shipped with a password of *NONE"

If you are expecting them to be disabled, you are mistaken.  They need to
be enabled to be used by the OS.

Charles

On Mon, Jul 15, 2024 at 7:12 AM Rich Loeber <rich@xxxxxxxxx> wrote:

> I'm looking at some recent IBM i documentation issued by IBM and I see the
> following statement:
>
> "All IBM-supplied user profiles except for QSECOFR are shipped with a
> password of *NONE and are not intended for sign-on. These profiles are used
> by the IBM i operating system. Therefore, signing on with these profiles or
> using the profiles to own user (non-IBM supplied ) objects is not
> recommended."
>
> After exploring the current settings on both a 7.4 and 7.5 box, I don't
> find this to be the case.  Many IBM supplied profiles are there with a
> password present.  Here's a brief example of the SQL output that I'm seeing:
>
> Authorization  No         Status      User
> Name           Password               Class
>                Indicator              Name
>  QANZAGENT        YES     *ENABLED    *SYSOPR
>  QCLUMGT          YES     *DISABLED   *USER
>  QCLUSTER         YES     *ENABLED    *USER
>  QDIRSRV          YES     *ENABLED    *USER
>  QIBMHELP         YES     *ENABLED    *SYSOPR
>  QLPAUTO          YES     *ENABLED    *SYSOPR
>  QLPINSTALL       YES     *ENABLED    *SYSOPR
>  QPGMR            YES     *ENABLED    *PGMR
>  QPM400           YES     *ENABLED    *USER
>  QRJE             YES     *ENABLED    *PGMR
>  QSECOFR          NO      *ENABLED    *SECOFR
>  QSRV             YES     *ENABLED    *PGMR
>  QSRVAGT          YES     *ENABLED    *SYSOPR
>  QSRVBAS          YES     *ENABLED    *PGMR
>  QSYS             YES     *ENABLED    *SECOFR
>  QSYSOPR          YES     *ENABLED    *SYSOPR
>  QTCM             YES     *DISABLED   *USER
>
> Is this typical?
>
> Or, is the IBM documentation that I'm look at (CIS IBM i V7R5M0 Benchmark)
> just incorrect.
>
> Rich Loeber
> Kisco Systems LLC
> https://www.kisco.com
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/midrange-l.
>
> Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
> questions.