Re: Prevent User Profile from using public authority

I was going to stay out of this one.  Now, I've had a nice weekend and I 
am playing a bit of catch up so I don't feel like reviewing to the nth 
degree but this is what we do on SOME of our machines.

CHGSYSVAL QCRTAUT *EXCLUDE.
CRTAUTL MYAUTL
ADDAUTLE MYAUTL  USER(*PUBLIC) AUT(*EXLUDE)
CHGLIB ... CRTAUT(MYAUTL)  any new objects will be created secured with 
that authorization list.
CHGAUT OBJ('/qsys.lib/mylib.lib') AUTL(MYAUTL)
CHGAUT OBJ('/qsys.lib/mylib.lib/*') AUTL(MYAUTL)
CHGAUT OBJ('/qsys.lib/mylib.lib') USER(*PUBLIC) AUTL(MYAUTL)
CHGAUT OBJ('/qsys.lib/mylib.lib/*') USER(*PUBLIC) AUTL(MYAUTL)

A new user on this machine does not even have access to a 5250 session 
until they are added to the proper authorization list.

No, we are not using "application only" access on this machine.  With that 
access the only way to access files is by calling programs that adopt 
authority.  However, we have no user written programs on this machine, nor 
any canned "traditional" packages.  It's all Domino and some ftp exit 
points for our ftp site.  And, some ifs shares set up for our internal 
users to process ftp data.


Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.