Re: List of commands that need special authority.

[Michael Mayer <michael.mayer@xxxxxxxxxxxxx>]

Good day all. This subject kind of piqued my interest.
I decided to run it by Scott Forstie - IBM i DB Architect and SQL wizard - as you all know.

His answer to the question of:

" ... wanted to track every command that needs a special authority.  For instance, putting auditing on say, CRTLINETH command, which needs IOSYSCFG.  I haven?t figured out a way to get a list and there?s no way I will do F1 on all the commands on the system and record if, and what, special authority that a command would need ... "

Scott's reply was and I quote:
" ... No good answer on this one.
The help text isn't query-able (afaik) and there isn't a guarantee that all command help text is equal ... "



Respectfully,
Michael Mayer
IBM i on Power System Admin
ERMCO-ECI
2225 Industrial Rd
Dyersburg, Tennessee 38024
Cell, Office and Text Messages: 518.641.8906
Email: michael.mayer@xxxxxxxxxxxxx
https://www.ermco-eci.com/
https://ermcopower.com/
IBM i Award Winning Blog Site: https://ibmireference.blogspot.com/
Awarded IBM 2024/2025 Advocate, Contributor, Influencer and IBM i Ready Badges.



   2. Re: List of commands that need special authority.
      (Vern Hamberg via MIDRANGE-L)
   3. Re: List of commands that need special authority. (Rob Berendt)
   4. Re: List of commands that need special authority. (Bryan Dietz)

----------------------------------------------------------------------

message: 1
date: Tue, 22 Apr 2025 20:17:35 +0000
from: "Smith, Michael via MIDRANGE-L" <midrange-l@xxxxxxxxxxxxxxxxxx>
subject: List of commands that need special authority.

I?m trying to do some security clean up on several LPARs.  While a needed improvement, the Authority Collection process doesn?t quite get everything that I need.  I wanted to track every command that needs a special authority.  For instance, putting auditing on say, CRTLINEETH command, which needs IOSYSCFG.  I haven?t figured out a way to get a list and there?s no way I will do F1 on all the commands on the system and record if, and what, special authority that a command would need.

Any ideas how to track that down?

As I?ve told the folks that I?ve trained on the iSeries over the years, ?F1 and F4 are your friend, use them.?, but not in this case ?

TIA

Mike.


------------------------------



------------------------------

message: 2
date: Tue, 22 Apr 2025 16:50:29 -0500
from: Vern Hamberg via MIDRANGE-L <midrange-l@xxxxxxxxxxxxxxxxxx>
subject: Re: List of commands that need special authority.

Hi Mike

How about a couple brute force methods?

1. OCR the Security PDF or pull Table 157. Maybe convert it into a
spreadsheet, somehow.



        Authority needed
Command         Referenced object       For object      For library
CRTLINETH       Controller description (NETCTL)         *USE    *EXECUTE

        Line description
        *READ, *ADD

        Network interface description (NWI)     *USE    *EXECUTE

        Network server description (NWS)        *USE    *EXECUTE



2. DSPCMD to get the panel group for its help text
 ??? a. DMPOBJ of the panel group
 ??? b. Parse through the spooled file for parts of words like "estricti"
 ??? ??? i. I know, a tough assignment, right?

*Regards*

*Vern Hamberg*

IBM Champion 2025 <cid:part1.cnpltJqL.rjVbFXHW@centurylink.net> CAAC
(COMMON Americas Advisory Council) IBM Influencer 2023

On 4/22/2025 4:03 PM, Smith, Michael via MIDRANGE-L wrote:
> Jack,
>
> To me that?s showing a ton of detail how you would have gotten access to run a command, like *USE, *ALLOBJ, or adopted authority.
>
> I initially had a ticket opened with IBM because I couldn?t remember the Authority Collection piece and after going round with them with several emails, we determined that we cannot get the information I?m looking for through that process.
>
> So, while it is valuable to know who has access to run a command like CRTLINETH, you still need a special authority to make it work.   So, I?m looking for a way to get all those commands.  Also helps if someone needs say *IOSYSCFG, to know what other commands (if they have *USE), they could possibly use.
>
>
>
> From: Jack Woehr<jack.woehr@xxxxxxxxxxx>
> Sent: Tuesday, April 22, 2025 4:46 PM
> To: 'midrange-l@xxxxxxxxxxxxxxxxxx'<midrange-l@xxxxxxxxxxxxxxxxxx>
> Cc: Smith, Michael<Mike.Smith@xxxxxxxxxxxxxxxxxxxx>
> Subject: [EXTERNAL] Re: List of commands that need special authority
>
> Security First: This is an external email. Use caution clicking links or opening attachments.
> The answer is 42 ? i.e., SQL
>
> See Authority collection views
>
> https://www.ibm.com/docs/en/i/7.5.0?topic=collection-authority-views
>
> Jack Woehr
> Independent Consulting Programmer