Re: Security level change

At 22-03-2000 11:02:03 Jim_Hawkins wrote:

>We are currently at security level 30 on our AS/400 and  on Version 3.5.1
> of JBA.  We will soon be going to 3.5.2b of JBA and would also (as a
> separate project) upgrade our security to level 40.  What is involved in
> making this security change?
>

You need to turn on the system audit journal.  Create the journal QAUDJRN
in QSYS.  Change the system value QAUDCTL to specify *AUTFAIL and *PGMFAIL.
Use the DSPJRN command or option 20 (DSPAUDJRNE) on the security toolkit
menu to check for functions which will fail under level 40 even though they
work under level 30.

     DSPJRN JRN(QAUDJRN) JRNCDE(T) ENTTYP(AF)

First position of the entry specific data on the display indicates
violation type for authority failures.

Types of errors include the following:
     A - user not authorized to object (normal authority failure unrelated
to level 40)
     B - attempt to run restricted machine interface instruction
     C - restore validation error
     D - attempt to access object in unsupported manner
     J - SBMJOB using a job description which specifies a user profile to
which the submitter did not have *USE authority
     R - hardware storage protection violation, .e. attempt to access
object in unsupported manner
     S - Attempt to sign on without a user profile and password

You MUST resolve all of the errors (except type A) BEFORE going to level 40
or you are likely to have problems.  Types B, C, D, and R are generally
caused by vendor programs performing unsupported functions.  If you do not
have the source for the program, you are in trouble.

Type J is a real pain.  To be able to use a job description with a
hardcoded user profile under level 40, the submitter must have at least
*USE authority to that user profile.  Either remove the hard coded user
profile and insure your batch jobs still run or grant the appropriate
authority to the hardcoded user profile.  The former is by far preferable
to the latter.

AFTER YOU HAVE RESOLVED ALL OF THE SECURITY ERRORS, to change to level 40
security, change the system value QSECURITY to '40' and IPL the machine.
If you have problems you can change it back to '30' and IPL again.

THIS IS NOT INTENDED TO BE A COMPLETE LIST OF EVERYTHING REQUIRED TO GO TO
LEVEL 40 SECURITY.  Please refer to the appropriate security manuals.

Good luck.


+---
| This is the JBA Software Users Mailing List!
| To submit a new message send your mail to JBAUSERS-L@midrange.com.
| To subscribe to this list send email to JBAUSERS-L-SUB@midrange.com.
| To unsubscribe from this list send email to JBAUSERS-L-UNSUB@midrange.com.
| Questions should be directed to the list owner: doug333@aol.com.
+---