Re: IFS permissions question

[Jack Kingsley <iseriesflorida@xxxxxxxxx>]

Pete, I recall having a problem a while ago that was similar.  I was given
these instructions from IBM, you could try them and see if it solves your
problem.

end qhttpsvr  sbs

run these exitpgms one at a time....



 QSYS/CALL PGM(QSYSDIR/QLWINSTALL)

QSYS/CALL PGM(QSYS/QLWIMIG) PARM(*AUTH *SS03)

QSYS/CALL PGM(QSYS/QLWIMIG) PARM(*AUTH *DG1)

I would probably run these as QSECOFR.

On Mon, Jan 14, 2013 at 2:31 PM, Pete Helgren <pete@xxxxxxxxxx> wrote:

> I have removed two users from all folders who are no longer authorized
> to my IBM i.  I disabled their user profiles and removed their authority
> from all files and folders.  When I attempt to edit a configuration
> file  using the GUI I get the following error:
> *Error:* ZUI_50008: You do not have the necessary authority to update
> configuration file */www/myapps/conf/httpd.conf*.
>
> The myapps folder has the following authority:
> *PUBLIC *X
> PETE *RWX (and all object authorities)
> QTMHHTTP *X (an no object authorities)
>
> and the /www/myapps/conf folder has:
> *PUBLIC *X
> QSYS *RWX (and all object authorities)
> PETE *RWX (and all object authorities)
> QTMHHTTP *X (an no object authorities)
>
> When I create a brand new HTTP server instance using the ADMIN GUI I see
> the following:
> *Error:* ZUI_50009: An unknown error occurred attempting to update
> configuration file */www/testsec/conf/httpd.conf*.
>
> The folders and files created by the GUI have the following permissions:
> *PUBLIC *X
> PETE *RWX (and all object authorities)
> QTMHHTTP *X (an no object authorities)
>
> I (PETE) have all authorities on the system.
>
> Something was changed, perhaps by the user who had the original
> authorities on the folders and has now been removed.  I would have
> thought that a "clean" creation of a new HTTP instance would have the
> correct authorities (which I think would have QTMHHTTP with *RXW and all
> authorities on all objects, correct?)
>
> Where are the "controls" that determine what an HTTP instance has
> regarding authority?  How do I fix this (is it a user profile issue on
> QTMHHTTP?)?
>
> --
> Pete Helgren
> www.petesworkshop.com
> GIAC Secure Software Programmer-Java
>
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/web400.