RE: security of spooled files

["Shaw, David" <dshaw@xxxxxxxxxxx>]

Jim,

There's another potential exposure with *ALLOBJ users - there is a way that
they can give themselves *SPLCTL authority at any time.  I presume that
you're monitoring for that in your security audit as well - if not, you
should be.

As a general statement: A user with *ALLOBJ can grant himself any other
special authority at any time.  Some of you may think that this is not true,
since he can't DIRECTLY do it, but there is an indirect method to accomplish
it.  Be warned!

Dave Shaw
Spartan International, Inc.
Spartanburg, SC
To subscribe to the MAPICS-L mailing list send email to
MAPICS-L-SUB@midrange.com or go to www.midrange.com and follow the
instructions.

-----Original Message-----
From: Jim Franz [mailto:jfranz@triad.rr.com]
Sent: Wednesday, October 18, 2000 11:15 PM
To: RPG400-L@midrange.com
Subject: Re: security of spooled files


> >I was wondering if anyone had any ideas of how to secure my payroll
> >processor's spool files.  Her reports and etc are accessible to others.
>
> As far as I know, you will never be able to prevent the holders of ALLOBJ
> authority being able to see the spool files without some kind of
> application level intervention

A minor point, but a user with ALLOBJ cannot read a spool file in an outq
where public is excluded, the owner is a payroll group, the dspdta is
*owner,
operator control is *no.
It is SPLCTL that gives the unlimited authority. The lowliest user,
specifically
excluded from a lib/outq but with SPLCTL can read the spool file. I think of
outq & spool security as securing particular data within a file. ALLOBJ may
give someone access to control the Qxxxxxxx file with spool data in it, but
not necessarily the reading of the spool data of a particular outq.
But, the ALLOBJ user has the rights to change the outq, and remove
the specific authority and only then read the spool. That shows up in the
security audit.
I hope I said all this correctly, but it's been keeping QSECOFR out of
payroll in several sites. jim

+---
| This is the RPG/400 Mailing List!
| To submit a new message, send your mail to RPG400-L@midrange.com.
| To subscribe to this list send email to RPG400-L-SUB@midrange.com.
| To unsubscribe from this list send email to RPG400-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator:
david@midrange.com
+---
+---
| This is the RPG/400 Mailing List!
| To submit a new message, send your mail to RPG400-L@midrange.com.
| To subscribe to this list send email to RPG400-L-SUB@midrange.com.
| To unsubscribe from this list send email to RPG400-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---