Re: iSeries Command Log - Possible Security Flaw?

Hi BJ,

On the iSeries, job logs are visible to other users, so for security
issues, hidden parameters of CL commands do not appear.
The iSeries command log view is not accessible outside of the PC that WDSC
is running on (the job logs that WDSC produces do not display the hidden
parameters)
However, the behaviour should imitate that of the iSeries, so I have opened
APAR SE27679 to track the issue.

thanks,

Violaine Batthish
WebSphere Development Studio Client, IBM Toronto Lab


wdsci-l-bounces+batthish=ca.ibm.com@xxxxxxxxxxxx wrote on 12/18/2006
01:28:57 PM:

From the iSeries Command Log view, I ran the command CHGUSRPRF MYUSERID

PASSWORD(MYPASSWORD). In response, the iSeries Command Log displayed the
entire command including the password instead of stripping the password

like

the native 5250 interface does. I consider this a security flaw, what say
you?

Speaking of the iSeries Command Log view, is there any way to have the
command entry combo box at the bottom of the view be available even if I
have not yet entered one command?


Kind regards,

BJ