RE: [Security400] SQL and IT Controls

[CWilt@xxxxxxxxxxxx]

Edwin,

No problem.  Though I don't think the vendor will be able to help.

Basically, as I understand it.  STRSQL and SQLRPGLE for that matter talk
directly to the DB.  They don't go through the DB servers that a remote
client uses to communicate with the DB.  So the exit programs that these
type of products make use of, aren't called.

There's a related thread in MIDRANGE-L:
http://archive.midrange.com/midrange-l/200411/msg00654.html



Charles Wilt
iSeries Systems Administrator / Developer
Mitsubishi Electric Automotive America
ph: 513-573-4343
fax: 513-398-1121
 

> -----Original Message-----
> From: Edwin Davidson [mailto:EDavidson@xxxxxxxxxxxx]
> Sent: Tuesday, November 23, 2004 2:10 PM
> To: Security Administration on the AS400 / iSeries
> Subject: Re: [Security400] SQL and IT Controls
> 
> 
> Wow, you've opened up our eyes.  Thank you.  That is a major issue.
> 
> With that product, the goal is to lock down your system.  
> While we see 
> individual
> SQL commands in the log, your are right.  STRSQL and SQLRPGLE 
> is not logged.
> We are checking with the vendor.  If I find anything out that says it 
> WILL/CAN do this
> I will post back.
> 
> Edwin Davidson
> 
>