Re: [Security400] Work with TCP/IP Interfaces: Start/End authority?

["Jim Franz" <franz400@xxxxxxxxxxxx>]

> Is there a reference that I can goto and ask, figuratively speaking, this
type of question?
Dan - Title: OS/400 Security - Reference V4R5 Document Number: SC41-5302-04
According to the V4R5 Security Reference
http://publib.boulder.ibm.com/pubs/html/as400/online/v4r5eng.htm
the strtcpifc is shipped *exclude for *public (as it should be). The cmd
only requires *use, which must be granted, or have *allobj (not so wise). I
would assume you also need *use to the objects attached to the ifc (line,
ctl,etc)
You need *iosyscfg to config the line, ctl, etc, but not to start the
interface. According to the manual, "System configuration (*IOSYSCFG)
special authority gives the user the ability to change how the system is
configured."
This does not include operational things like STRxxx and ENDxxx (none that i
can think of).
For many releases, the Security Reference manual has documented the
authorities needed to execute each command. Any changes to the authorities
is documented in the Read Me First or Release Changes notes. I did try the
Info Center for V5R1, and had the usual "pages of links that didn't answer
the search".
I know Phil suggested iosyscfg special auth, but I beleive the manual above
is correct.
sorry if this is a little wordy....
jim franz

----- Original Message -----
From: "Phil" <sublime78ska@yahoo.com>
To: <security400@midrange.com>
Sent: Monday, August 20, 2001 5:47 PM
Subject: RE: [Security400] Work with TCP/IP Interfaces: Start/End authority?


> I would first check *IOSYSCFG
>
> Phil
>
> > -----Original Message-----
> > From: security400-admin@midrange.com
> > [mailto:security400-admin@midrange.com]On Behalf Of Bale, Dan
> > Sent: Monday, August 20, 2001 5:38 PM
> > To: security400@midrange.com
> > Subject: [Security400] Work with TCP/IP Interfaces: Start/End authority?
> >
> >
> > This is a multi-part message in MIME format.
> > --
> > [ Picked text/plain from multipart/alternative ]
> > O.K., here's my first question!
> >
> >                Work with TCP/IP Interfaces
> >                                           System: S1234567
> > Type options, press Enter.
> >   1=Add  2=Change  4=Remove  5=Display  9=Start  10=End
> >
> >     Internet        Subnet            Line      Line  Interface
> > Opt Address         Mask           Description  Type  Status
> > __  ______________
> > __  127.0.0.1       255.0.0.0      *LOOPBACK   *NONE  Active
> > __  111.22.33.44    255.255.255.0  HDLENET     *ELAN  Active
> >
> > (Get this screen via CFGTCP, option 1)
> >
> > This weekend, our U.K. branch did a manual IPL to add DASD, and
> > apparently the TCP/IP interfaces were not automatically (?) started.  So
> > our branch admin attempted to use Work with TCP/IP Interfaces, but he
> > did not see options 9=Start & 10=End.  They ended up doing a normal IPL
> > and the TCP/IP Interfaces started up.
> >
> > What do I need to do to give this admin the required authority to start
> > and end TCP/IP interfaces?  While I would appreciate a direct answer, I
> > would also desire to know *where* I can find this information.  Is there
> > a reference that I can goto and ask, figuratively speaking, this type of
> > question?
> >
> > Dan Bale
> > IT - AS/400
> > Handleman Company
> > 248-362-4400  Ext. 4952
> > D.Bale@Handleman.com
> >   Quiquid latine dictum sit altum viditur.
> >   (Whatever is said in Latin seems profound.)
> > _______________________________________________
> > This is the Security Administration on the AS400 / iSeries
> > (Security400) mailing list
> > To post a message email: Security400@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/security400
> > or email: Security400-request@midrange.com
> >
>
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com
>
> _______________________________________________
> This is the Security Administration on the AS400 / iSeries (Security400)
mailing list
> To post a message email: Security400@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/security400
> or email: Security400-request@midrange.com
>