Re: security of spooled files

["Jim Franz" <jfranz@xxxxxxxxxxxx>]

> >I was wondering if anyone had any ideas of how to secure my payroll
> >processor's spool files.  Her reports and etc are accessible to others.
>
> As far as I know, you will never be able to prevent the holders of ALLOBJ
> authority being able to see the spool files without some kind of
> application level intervention

A minor point, but a user with ALLOBJ cannot read a spool file in an outq
where public is excluded, the owner is a payroll group, the dspdta is
*owner,
operator control is *no.
It is SPLCTL that gives the unlimited authority. The lowliest user,
specifically
excluded from a lib/outq but with SPLCTL can read the spool file. I think of
outq & spool security as securing particular data within a file. ALLOBJ may
give someone access to control the Qxxxxxxx file with spool data in it, but
not necessarily the reading of the spool data of a particular outq.
But, the ALLOBJ user has the rights to change the outq, and remove
the specific authority and only then read the spool. That shows up in the
security audit.
I hope I said all this correctly, but it's been keeping QSECOFR out of
payroll in several sites. jim

+---
| This is the RPG/400 Mailing List!
| To submit a new message, send your mail to RPG400-L@midrange.com.
| To subscribe to this list send email to RPG400-L-SUB@midrange.com.
| To unsubscribe from this list send email to RPG400-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---