Re: [Security400] Welcome to the Security400 Mailing List @ Midrange.com !

["John Earl" <johnearl@xxxxxxxxxxxxxxxxxx>]

Phil,

> On the Code/400 list we were talking about how to open an IFS file
from Code
> Edit.  It opens a java app that allows you to browse the IFS
(including
> qsys.lib)  The folders do not need to be shared through OpsNav, a
version of
> client access that supports mapping drives doesn't need to be
installed, and
> the QFWPSERVER authorization list doesn't prevent access to
qsys.lib.
>
> I have had no trouble securing folders other than qsys.  QSYS,
however, is
> much more difficult because many apps require users to do things
users
> normally aren't authorized to do (ADDPFM, RMVPFM etc) so authority
is lax.
>
> Has anyone gone though another vendor's app, changed all file
authorities to
> public *exclude, change the owner to a profile that can't sign on,
and then
> change the initial programs to use adopted authority *owner?

I can't answer the question as asked, but it is worth noting that the
IFS does not support the adopted authority concept.  You can define
your programs as USRPRF(*OWNER), it's just that the adopted authority
will not work when accessing objects outside of QSYS.LIB.   You'll
have to use some other authority method in the IFS.

jte

--
John Earl - VP & CTO
The Powertech Group
253-872-7788
johnearl@powertechgroup.com
www.powertechgroup.com